PT-2026-67664

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2025-15544

CVE-2025-15544 describes a cryptographic weakness in the Omada device adoption process where site management credentials are transmitted using a weak hashing algorithm, potentially allowing an attacker who intercepts adoption traffic to recover valid credentials and gain unauthorized access to ma...

CVE-2025-15544 Weak Credential Protection During TP-Link Omada Device Adoption

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

CVE-2026-68584

CVE-2026-68584 affects SiYuan before v3.7.3. An authentication bypass exists in publish mode: content endpoints that return headings or backlinks (getHeadingChildrenDOM, getHeading*Transaction, getBacklinkDoc) do not enforce the password check, even though the main getDoc endpoint is protected. A...

CVE-2026-68584 SiYuan before v3.7.3 Authentication Bypass via Content Endpoints

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

Security update for perl-DBI

This update for perl-DBI fixes the following issues: CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process...

CVE-2026-69082 Cross-Site Request Forgery in the Administrative User Deletion Endpoint

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

EUVD-2026-52257

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-69082

CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/ endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or...

CVE-2026-8793 PaperCut NG/MF: Insufficient brute-force protection

PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanis...

v2ray-core v5.53.0

Project V Project V is a set of network tools that helps you to build your own computer network. It secures your network connections and thus protects your privacy. Related Links Documentation and Newcomer's Instructions Welcome to translate V2Ray documents via Transifex Packaging Status If you a...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server Liberty is affected by a security bypass issue (CVE-2026-5516)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is affected by a security bypass issue. This issue has been addressed in this release. Vulnerability...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service (DoS) flaw (CVE-2024-26308, CVE-2024-25710)

Summary IBM Storage Protect Data Protection for Virtual Environments uses multiple Apache Commons libraries that were affected by Denial of Service DoS flaw. All those libraries have been upgraded and this issue has been addressed in this release. Vulnerability Details CVEID:CVE-2024-26308...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments' WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (CVE-2026-4410)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service. This issue has been addressed i...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses WebSphere Application Server Liberty, which is vulnerable to cross-site scripting (CVE-2025-12635)

Summary IBM Storage Protect Data Protection for Virtual Environments uses IBM WebSphere Application Server Liberty as part of its web application runtime. The WebSphere Application Server Liberty is vulnerable to cross-site scripting. This issue has been addressed in this release. Vulnerability...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments incorporates Oracle's January 2026 Critical Patch Update (CPU) to fix multiple security vulnerabilities (CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925)

Summary IBM Storage Protect Data Protection for Virtual Environments incoprporates the security fixes related to Oracle's January 2026 Critical Patch Update CPU. The IBM SDK, Java Technology Edition Critical Patch Update CPU bundles several security updates from Oracle to address multiple...

ROS-20260803-73-0013

The vulnerability of the xhciwrite64 function in the drivers/usb/host/xhci.h module of the Linux device support driver library is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow an attacker t...

The vulnerability of the Azure Active Directory identity management and protection platform, related to the execution of a loop with an unavailable exit condition, allows a perpetrator to trigger a service failure.

The vulnerability of the Azure Active Directory identity management and protection platform is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

The vulnerability of the Azure Active Directory identity management and protection platform, related to deserialization mechanism flaws, allows attackers to trigger a service failure.

The vulnerability of the Azure Active Directory identity management and protection platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

[SECURITY] Fedora 44 Update: lemonldap-ng-2.23.2-1.fc44

LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...