GHSA-9GM5-9RFH-M6VX CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...

Security Bulletin: Vulnerability in jackson-databind affects DB2 Dev Extension (CVE-2026-59888, CVE-2026-59889)

Summary Upgraded jackson-databind to 2.21.5 to remediate CVE-2026-59888 Improperly Controlled Modification of Dynamically-Determined Object Attributes and CVE-2026-59889 Incorrect Authorization — CVSS Base Score 6.5 Medium — PVR0820325. Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION:...

WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Modification / Site-Wide Template Takeover vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Foxtool All-in-One versions = 2.5.3...

WordPress Filter Gallery plugin <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Modification vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Filter Gallery versions = 1.1.4...

CVE-2026-54239

FaustWP (a WordPress plugin within the Faust.js headless WordPress toolkit) contains an authentication bypass prior to version 1.8.11 . The root cause is in WPE\FaustWP\Auth\encrypt() and decrypt() (in plugins/faustwp/includes/auth/functions.php): the 16-byte initialization vector is excluded fro...

CVE-2026-54239 FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt and WPE\FaustWP\Auth\decrypt in...

CVE-2026-54677 Scoold: Authenticated user can post replies and comments to private-space questions without space membership

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply...

CVE-2026-92949

A flaw was found in vm2, a JavaScript sandbox. This vulnerability allows sandboxed scripts to bypass security protections, specifically vm.freeze and vm.readonly, which are designed to prevent unauthorized modifications to objects. An attacker can exploit this by directly accessing and invoking...

Modification of Assumed-Immutable Data (MAID)

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID in the Object.getOwnPropertyDescriptor or lookupSetter process. An attacker can modify properties that we...

CVE-2026-14850

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

EUVD-2026-81522

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-14850 Weak password recovery mechanism for forgotten password in MobiAPParc

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-14850

MobiAPParc has a vulnerability in its password reset functionality caused by improper validation of the user_id parameter . Because this numeric identifier is predictable, an unauthenticated attacker over the network can reset passwords for arbitrary users without proving account ownership , lead...

BIT-MONGODB-2026-18698 Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations,...

Security update for cjose

This update for cjose fixes the following issues: CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose can...

SUSE-SU-2026:4237-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...

CVE-2026-15688

Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in...

CVE-2026-50609 Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, thi...