CVE-2026-14848 Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

EUVD-2026-52586

The Paid Membership Subscriptions WordPress plugin before 3.0.8 does not verify that the subscription being modified through its change-subscription checkout belongs to the current user, allowing any authenticated user with Subscriber-level access and above to take over another member's...

EUVD-2026-52585

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

CVE-2026-18739

A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacke...

CVE-2026-21011

creationtimestamp| type| source ---|---|--- 2026-08-04 03:00:04+00:00| seen| https://t.me/GithubRedTeam/96519 2026-08-05 00:00:56+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96519...

GHSA-2RC9-8CX9-FXPR vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-runner-fips, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, gitlab-cng-fips, gitlab-rails-ce-fips, gitlab-cng, gitlab-rails-ce...

CVE-2026-14351 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-runner-fips, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, gitlab-cng-fips, gitlab-rails-ce-fips, gitlab-cng, gitlab-rails-ce...

Exploit for CVE-2026-21019

--- CVE-2026-21019 – Kubernetes CronJob Suspended Execution...

UBUNTU-CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

Important: Red Hat Security Advisory: ldns security update

An update for ldns is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

PT-2026-67654

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the...

ROS-20260804-73-0005

The vulnerability of the blkmqelvswitchnone function in the block/blk-mq.c module, which supports the block-level kernel in the Linux operating system, is related to the assignment of a NULL pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...

Important: kernel-livepatch-6.18.30-61.119

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600...

Important: perl-YAML-Syck

Issue Overview: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syckhdlraddanchor and syckhdlrremoveanchor free the node stored unde...

Important: python3.9

Issue Overview: The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 In the Tarfile.extract function, the filter parameter is not passed properly when extracting...

ALSA-2026:49927 Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: urllib3: urllib3: Information disclosure via cross-origin redirects...

Important: rclone

Issue Overview: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing ...

CVE-2026-18685

creationtimestamp| type| source ---|---|--- 2026-08-03 23:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7p5zk45z2f 2026-08-04 00:00:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/117034296046822265 2026-08-04 00:00:39+00:00| seen|...

SUSE CVE-2026-8400

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

SUSE CVE-2026-17566

pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...