CVE-2026-97227 NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-97227 NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

CVE-2026-97227

The NextScripts: Social Networks Auto-Poster WordPress plugin (versions before 4.4.8 ) is vulnerable to an authentication bypass. The plugin fails to perform proper capability or ownership checks on several AJAX actions, relying solely on a nonce . This allows users granted access to posting feat...

Palo Alto Expedition - SQL Injection

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

CVE-2026-97227: Missing Authorization

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social...

PT-2026-99507

Name of the Vulnerable Software and Affected Versions NextScripts: Social Networks Auto-Poster WordPress plugin versions prior to 4.4.8 Description The plugin fails to perform capability or ownership checks on several AJAX actions, relying solely on a nonce. This allows users who have been grante...

CVE-2026-100373

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-100373: Server-Side Request Forgery (SSRF)

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

Extreme Network Fabric Engine < 9.3 Authentication Bypass (SA-2025-115)

The version of Extreme Networks Fabric Engine installed on the remote host is missing a security update. It is, therefore, affected by an authentication bypass vulnerability. - A vulnerability in Extreme Networks Fabric Engine VOSS before 9.3 was discovered. When SD-WAN AutoSense is enabled on a...

F5 Networks BIG-IP : BIG-IP APM vulnerability (K000162605)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.5.0.41.14 / 17.5.1.9.0.160.12 / 21.1.0.2.0.30.22. It is, therefore, affected by a vulnerability as referenced in the K000162605 advisory. When a BIG-IP APM access policy and an OAuth profile are configured on a...

Vulnerability concealment in F5 Networks BIG-IP Access Policy Manager

F5 Networks has identified a vulnerability in BIG-IP Access Policy Manager APM. This vulnerability allows unauthorized malicious actors to execute malicious code. To do this, the malicious actor needs to send malicious network traffic to the vulnerable system. BIG-IP APM systems are only vulnerab...

SAGEGAN: Style-Based Anomaly Detection with Gaussian Embeddings Using Generative Adversarial Networks

Malware evolves faster than rule-based and signature-driven detection pipelines. This paper presents SAGEGAN, a benign-only trained malware anomaly detection framework that converts portable executable files into compact three-channel images and models benign structure through style-conditioned...

USN-8661-5 linux-raspi vulnerabilities

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. CVE-2025-275...

PT-2026-97042

Name of the Vulnerable Software and Affected Versions Autonomy Logic OpenPLC version 3 Description An improper neutralization of input during web page generation occurs in the web interface when routing programs based on a query string parameter that is not encoded. This cross-site scripting XSS...

Stress-Testing Structure-Aware Calibration of Malware Graph Neural Networks under Type Shift

Post-hoc malware calibrators can condition confidence on graph structure, but their structural inputs may leave the support represented by validation data under malware-type shift. We study this risk on MalNet-Tiny by holding out each of four malware types across three seeds, freezing a graph...

Weather Data Spoofing Attacks on Rain-Adaptive Millimeter-Wave Frequency Selection in V2X Communication Networks

Connected vehicles use millimeter-wave mmWave sidelinks for the data rates cooperative driving demands, and emerging designs select the carrier band from sensed rainfall. We show that this weather awareness is an attack surface: an adversary who spoofs only the rainfall input dictates the victim'...

F5 Networks BIG-IP : BIND vulnerability (K000163335)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000163335 advisory. A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from...

CVE-2026-20121

A logic error in the Object Group Search (OGS) implementation of Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to bypass configured access controls by sending traffic that should be blocked through the device. A successful exploit could let the attacker rea...