CVE-2026-85657 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization...

CVE-2026-85657

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.15.0 . The flaw resides in the Co-Authors, Multiple Authors, and Guest Authors Author Box functionality, where the profile_fields_user_email_value_prefix paramete...

PT-2026-91775

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile fields user email value prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input...

PT-2026-93187

Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame put file.cgi restore archive prefix validation. Attackers can exploit the flawed prefix check in put parame file cgi.c to bypass restricted restore archive handling...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper handling of Realm hierarchy checks in delegated administration. An attacker can gain unauthorized access to resources in sibling Realms by exploiting prefix-based matching in the authorization...

CVE-2026-73236

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73236

Apache Syncope is vulnerable to an incorrect authorization issue due to a flawed implementation of delegated administration security checks. The system relies on Realm hierarchy and prefix matches ; however, it fails to correctly distinguish between two sibling Realms that share the same initial ...

CVE-2026-73236 Apache Syncope: Cross-Realm authorization bypass in delegated administration

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73236

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

EUVD-2026-77474

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73236 Apache Syncope: Cross-Realm authorization bypass in delegated administration

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static used a simple string prefix check to determine whether a request should be treated as a static file. When configured with URL prefixes like "/css", it matched any request path that began with th...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in cookies in Google Chrome prior to version 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restrictions through a crafted HTML page...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memory leak in fib6rulesuppress The kernel causes a memory leak when a fib rule is present in IPv6 nftables firewall rules, and a suppressprefix rule is present in IPv6 routing rules used by certain tools such as...

Astra Linux – Vulnerability in qt4-x11, qtbase-opensource-src

In Qt versions prior to 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there may be an application crash in QXmlStreamReader due to a crafted XML string, causing a situation where a prefix is greater than a certain length...

Astra Linux – Vulnerability in Ruby-Rack

A security vulnerability exists in versions of Rack 2.2.3 and Rack 2.1.4, where reliance on cookies without validation/integrity checks allows an attacker to forge a secure or host-only cookie prefix...

PT-2026-91189

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-73236: Incorrect Authorization

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

Linux Distros Unpatched Vulnerability : CVE-2026-89581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX....

GHSA-8WQC-V2Q8-VFF2 @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...