CVE-2026-101088

Nezha is a server and website monitoring tool. In versions = 2.2.11 and 2.3.1, the service sentinel worker service/singleton/servicesentinel.go contains an incomplete fix for a previously reported nil dereference denial of service GHSA-qjpp-gffx-2wm9. The 2026-07-21 fix re-validated the service...

PT-2026-99716

Name of the Vulnerable Software and Affected Versions Nezha versions 2.2.11 through 2.3.0 Description The service sentinel worker in service/singleton/servicesentinel.go contains an incomplete fix for a nil dereference issue. An authenticated user with the member role who owns an agent can trigge...

EUVD-2026-86577

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'firstname' parameter parameter. This is due to insufficient...

Linux Distros Unpatched Vulnerability : CVE-2026-93249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to...

EUVD-2026-86387

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

CVE-2026-54461 Habitica: Regex Injection / ReDoS in Member Search

Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a...

Updated xdg-dbus-proxy packages fix security vulnerabilities

filtering for broadcast messages bypassing path/interface/member checks...

MGASA-2026-0446 Updated xdg-dbus-proxy packages fix security vulnerabilities

filtering for broadcast messages bypassing path/interface/member checks...

PT-2026-105619

filtering for broadcast messages bypassing path/interface/member checks...

CVE-2026-93249: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...

CVE-2026-52850: Authorization Bypass Through User-Controlled Key

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

DEBIAN-CVE-2026-67231

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verifyfun that overrides badcert, unknownca / badcert, selfsignedpeer when the presented cert "matches" a whitelisted one. The match key is extractissuerid/...

CVE-2026-67231

RabbitMQ (messaging and streaming broker) is vulnerable to a TLS client-authentication bypass in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. When the trust-store plugin is enabled and used as the verify_fun, the system improperly validates certificates by matching only the Issuer...

CVE-2026-90950 Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled...

CVE-2026-89331

The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators...

CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

CVE-2026-90951

The Paid Membership Subscriptions WordPress plugin (versions before 3.1.0 ) contains an incorrect authorization vulnerability. The root cause is that the plugin fails to bind an unauthenticated payment action to the requesting user. Specifically, an attacker who obtains another member's in-flight...

CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

WordPress FluentBoards plugin 1.95-2.0.15 - Unauthenticated Board Member Email Address Disclosure vulnerability

Unauthenticated Board Member Email Address Disclosure vulnerability discovered by vuxvinh in WordPress Plugin FluentBoards versions 1.95-2.0.15...

PT-2026-97190

Name of the Vulnerable Software and Affected Versions FluentBoards WordPress plugin versions prior to 2.1.0 Description The public, token-shared board feature fails to properly restrict the member data it returns. This allows unauthenticated users to disclose the email addresses of members...