CVE-2026-18028: Authorization Bypass Through User-Controlled Key

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

WordPress StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce plugin <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions = 2.1.0...

PT-2026-64452

Name of the Vulnerable Software and Affected Versions Knot Resolver versions prior to 6.4.1 Description A heap-based buffer overflow exists in the DoQ DNS-over-QUIC receive path, which could allow remote code execution. A heap-based buffer overflow occurs when a program writes more data to a...

Malicious code in n8n-nodes-quick-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a On require/import, index.js spawns /bin/bash wired to a TCP socket at hardcoded IP 103.27.109.184:8895, giving the remote operator an interactive she...

CVE-2026-16318 QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls

The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...

📄 WordPress Ads by WPQuads / Quick AdSense Reloaded 2.0.87 Unauthenticated SQL Injection

WordPress Ads by WPQuads / Quick AdSense Reloaded plugin version 2.0.87 contains an unauthenticated SQL injection vulnerability. A remote attacker can inject arbitrary SQL into database queries handled by the affected component. This proof of concept exploit demonstrates the vulnerable request fl...

Fedora 43 : rust-cargo-rpmstatus (2026-6d5a7be3b9)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d5a7be3b9 advisory. Update to 0.2.5 with dependency updates only, and further update some dependencies. Particularly, quick- xml 0.41 fixes RUSTSEC-2026-0194 and...

Fedora 43 : rust-opendal (2026-5e3ab17662)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5e3ab17662 advisory. Update quick-xml to 0.41 RUSTSEC-2026-0194, RUSTSEC-2026-0195 Tenable has extracted the preceding description block directly from the Fedora security advisor...

CVE-2026-44452 h2o is vulnerable to heap overrun

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it ...

Fedora 44 : rust-cargo-rpmstatus (2026-08f5aab9ed)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-08f5aab9ed advisory. Update to 0.2.5 with dependency updates only, and further update some dependencies. Particularly, quick- xml 0.41 fixes RUSTSEC-2026-0194 and...

security-audit-skill

security-audit skill A portable Agent Skillhttps://docs.cl...

EUVD-2026-36117

Sharp Missing Authorization Check in Quick Creation Command Endpoints...

Sharp Missing Authorization Check in Quick Creation Command Endpoints

Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that...

GHSA-VMWX-M75V-QVCH Sharp Missing Authorization Check in Quick Creation Command Endpoints

Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that...

GHSA-QHPR-79XW-32M8 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-gcp, linux-qemu-melange, linux-azure, linux-vmware...

GHSA-CM56-MVX6-66QM vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-gcp, linux-qemu-melange, linux-azure, linux-vmware...

GHSA-GVRM-XH5G-W8V6 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-gcp, linux-qemu-melange, linux-azure, linux-vmware...

[SECURITY] Fedora 43 Update: rust-quick-xml-0.41.0-1.fc43

High performance xml reader and writer...

[SECURITY] Fedora 44 Update: rust-quick-xml-0.41.0-1.fc44

High performance xml reader and writer...

Fedora 43 : rust-busd / rust-inferno / rust-quick-xml / rust-reqsign-aws-v4 / etc (2026-ffaebbf2f0)

"The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ffaebbf2f0 advisory. Update quick-xml for two security advisories, rebuild dependents, and update sandogasa to the latest https://rustsec.org/advisories/RUSTSEC-2026-0194.html...