Important: Red Hat Security Advisory: nginx:1.26 security update

An update for the nginx:1.26 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

nginx: NGINX: Heap buffer over-read allows memory modification or denial of service

A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...

Important: Red Hat Security Advisory: nginx:1.24 security update

An update for the nginx:1.24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

WordPress Newsletters plugin <= 4.17 - Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter vulnerability

Authenticated Author+ Arbitrary Modification via 'newslettersmailinglistsroles' POST Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Newsletters versions = 4.17...

WordPress My Agile Privacy® plugin <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions vulnerability

Missing Authorization to Unauthenticated Plugin Settings Modification via mapmissingcookieshield / mapcheckconsentmodestatus AJAX Actions vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin My Agile Privacy versions = 3.3.6...

Missing Authorization

Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Missing Authorization through the astgreprewrite function when the approval mechanism is not enforced. An attacker can modify arbitrary file...

nginx: NGINX: Heap buffer over-read allows memory modification or denial of service

A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...

EUVD-2026-65489

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-78581

CVE-2026-78581 is an authorization bypass (CWE-639) in Kibana affecting the AI Assistant feature. An authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-g...

CVE-2026-78581

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

WordPress Geo My WP plugin < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR vulnerability

Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin GEO my WordPress versions 4.5.5.3...

WordPress Hotel Booking Lite plugin < 6.2.3 - Subscriber+ Customer Data Modification via IDOR vulnerability

Subscriber+ Customer Data Modification via IDOR vulnerability discovered by Haitam Lazaar in WordPress Plugin Hotel Booking Lite versions 6.2.3...

WordPress YayPricing plugin < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure vulnerability

Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin YayPricing versions 3.5.7...

WordPress Themify Builder plugin <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action vulnerability

Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tbupdateolddata' AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Themify Builder versions = 7.8.0...

CVE-2026-17587

The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

RLSA-2026:59220 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

WordPress f4 Post Tree plugin < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification vulnerability

Subscriber+ Arbitrary Post Parent/Menu Order Modification vulnerability discovered by Mustafa Ahmed in WordPress Plugin F4 Post Tree versions 2.0.5...