SUSE SLES15 Security Update : dracut (SUSE-SU-2026:4078-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4078-1 advisory. - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. - CVE-2026-16445: Root code execution via DHCP...

CVE-2026-81654 NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site...

CVE-2026-15660

The SEO Booster WordPress plugin (versions up to 7.4.7 ) is affected by a Missing Authorization vulnerability in the handle_oauth_callback() function, which is hooked to admin_init . The function processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This a...

EUVD-2026-83468

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

CVE-2026-15660 SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

CVE-2026-15660 SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

PT-2026-95801

Name of the Vulnerable Software and Affected Versions TikTok plugin for WordPress versions prior to 1.4.2 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to overwrite...

PT-2026-95736

Name of the Vulnerable Software and Affected Versions SEO Booster versions prior to 7.4.8 Description The SEO Booster plugin for WordPress contains a missing authorization flaw. The handle oauth callback function, which is hooked to admin init, fails to perform a capability check when processing...

PT-2026-95778

Name of the Vulnerable Software and Affected Versions Real3D Flipbook Lite versions prior to 5.1.2 Description Stored Cross-Site Scripting is possible due to insufficient input sanitization and output escaping in the on shortcode and print global options functions. The issue occurs when shortcode...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PCD decoder when a specific command line option is supplied, which causes the decoder to bypass a configured resource limit. An attacker can exhaust system memory by...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

WordPress SEO Booster plugin <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback() vulnerability

Authenticated Subscriber+ Missing Authorization to Arbitrary Options Modification via handleoauthcallback vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SEO Booster versions = 7.4.7...

WordPress PuppyFW plugin <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability

Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PuppyFW versions = 0.4.4...

CVE-2026-92561

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...