PT-2026-86923

Improper Protection of Alternate Path vulnerability in ash-project ash lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053434)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053434 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that...

MAL-2026-15936 Malicious code in trongridew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...

Malicious code in trongridew (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 598687794d8452d6845a3529e26bf63838cedee736dc0b8545ad33abe2e827f3 The package exposes a single public function permprivatekey in main.py that unconditionally POSTs the caller-supplied Tron private key as JSON to the...

CVE-2026-86191 SiYuan before v3.8.2 Private Attribute View Key Enumeration

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-86176 NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark...

CVE-2026-86120

APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attackers with valid Fusion API tokens can write attachments to private datasheets they have been...

CVE-2026-81348

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-81348 My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

WordPress My Private Site plugin < 4.2.3 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Shivamani Vastrala in WordPress Plugin My Private Site versions 4.2.3...

CVE-2026-81348 My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-81348

The My Private Site WordPress plugin, specifically versions before 4.2.3 , contains a vulnerability where site-privacy access controls are not correctly applied to certain unauthenticated front-end read surfaces. This oversight allows unauthenticated users to view post content , comments , and po...

EUVD-2026-71852

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-78150 Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

WordPress Smart Post plugin 4.0.0-4.0.7 - Contributor+ Private and Protected Post Content Disclosure vulnerability

Contributor+ Private and Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

SUSE CVE-2026-3433

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 fail to restrict roleupdated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change...

SUSE CVE-2026-80776

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futexpivotpending during private hash resize A task performing a custom private hash resize can remain blocked in uninterruptible sleep indefinitely. The hung-task detector reports: INFO: task futex-resizer:314...

SUSE CVE-2026-80777

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec. exec has a gap...

SUSE CVE-2026-80778

In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mmusers reference. Nevertheless, attachtopiowner currently accepts an owner from a different address space and copies th...

CVE-2026-78150: Authorization Bypass Through User-Controlled Key

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...