CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-103930

The C++ header-only HTTP/HTTPS library cpp-httplib versions 0.29.0 through 0.51.0 contains a vulnerability in Client::open_stream within httplib.h . The issue stems from the library accepting a caller-controlled path that bypasses the detail::encode_path() protection used in other paths. This all...

CVE-2026-94260

The Sifalo Pay WordPress plugin (versions 2.0 - 2.5.2 ) contains a vulnerability where it fails to verify ownership or authorization when handling a payment return . This flaw allows unauthenticated attackers to write arbitrary payment session metadata onto any store order and force orders awaiti...

CVE-2026-94260 Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...

WordPress Sifalo Pay plugin 2.0-2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability

Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Sifalo Pay versions 2.0-2.5.2...

CVE-2026-91023 Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

CVE-2026-91023: Missing Authorization

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

CVE-2026-51915: Improper Access Control

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

Rocky Linux 8 [CIQ] Security Update: ctdb / ctdb-debuginfo / libsmbclient / libsmbclient-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_2074)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20222074 advisory. samba: Symlink race error can allow metadata read and modify outside of the exported share CVE-2021-20316 samba: Information leak via symlinks of existance...

Rocky Linux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781350676)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781350676 advisory. - A flaw was found in Samba's handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing...

CVE-2026-100614

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

EUVD-2026-87709

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

PT-2026-99285

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.244.1 Description A cross-tenant integrity issue exists in the metadata-cleaning worker. The worker trusts image object keys from mutable database rows without validating ownership, acting as a confused deputy. An...

PT-2026-96768

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

Astra Linux – Vulnerability in Python 3.11

It allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory, and modifying some file metadata. This vulnerability affects users who use the TarFile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract, with the...

SQL Injection

Apache Hive is vulnerable to SQL Injection. The vulnerability is due to unsanitized partition names being concatenated into direct SQL queries, allowing an authenticated user to alter partition lookups and read, modify, truncate, or affect unintended partition metadata...

CVE-2026-77787: Missing Authorization

The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit...

CVE-2026-13404: Authorization Bypass Through User-Controlled Key

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-74709

A flaw was found in the Linux kernel's xsk AFXDP sockets component. A local attacker, by manipulating metadata flags after request processing, could cause the kernel to write a timestamp into the metadata area even when not explicitly requested. This could lead to unintended data modification...

openSUSE 16: kubevirt1.8-container-disk / kubevirt1.8-libguestfs-tools / etc (openSUSE-SU-2026:21590-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21590-1 advisory. Update to version 1.8.4. Security issues fixed: - CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via...