CVE-2026-123097

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary use...

EUVD-2026-124844

The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and write arbitrary use...

CVE-2026-122327

A flaw was found in Meelo. The application fails to properly enforce administrative authorization checks on write routes for songs, tracks, and videos. An authenticated remote user with standard privileges can exploit this issue by submitting modification requests to these endpoints, allowing the...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-150499)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150499 advisory. Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are...

CVE-2026-13062

An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in...

Linux Distros Unpatched Vulnerability : CVE-2026-103930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches...

SUSE CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

DEBIAN-CVE-2026-103930

cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until 0.51.0, Client::openstream in httplib.h accepts a caller-controlled path that reaches detail::writerequestline without the detail::encodepath protection used by the ordinary buffered request path. Raw carriage-return and...

CVE-2026-103930

The C++ header-only HTTP/HTTPS library cpp-httplib versions 0.29.0 through 0.51.0 contains a vulnerability in Client::open_stream within httplib.h . The issue stems from the library accepting a caller-controlled path that bypasses the detail::encode_path() protection used in other paths. This all...

CVE-2026-94260 Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...

CVE-2026-94260

The Sifalo Pay WordPress plugin (versions 2.0 - 2.5.2 ) contains a vulnerability where it fails to verify ownership or authorization when handling a payment return . This flaw allows unauthenticated attackers to write arbitrary payment session metadata onto any store order and force orders awaiti...

WordPress Sifalo Pay plugin 2.0-2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability

Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Sifalo Pay versions 2.0-2.5.2...

PT-2026-113960

Name of the Vulnerable Software and Affected Versions cpp-httplib versions 0.29.0 through 0.50.0 Description The Client::open stream function in httplib.h accepts a caller-controlled path that reaches detail::write request line without the protection of detail::encode path. This allows raw...

CVE-2026-91023 Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

CVE-2026-91023: Missing Authorization

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including...

CVE-2026-51915: Improper Access Control

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

Rocky Linux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1781350676)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781350676 advisory. - A flaw was found in Samba's handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing...

Rocky Linux 8 [CIQ] Security Update: ctdb / ctdb-debuginfo / libsmbclient / libsmbclient-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_2074)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20222074 advisory. samba: Symlink race error can allow metadata read and modify outside of the exported share CVE-2021-20316 samba: Information leak via symlinks of existance...

CVE-2026-100614

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...