EUVD-2026-53874

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...

CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

macOS 15.x < 15.7.9 (148171)

The remote host is running a version of macOS / Mac OS X that is 15.x prior to 15.7.9. It is, therefore, affected by a vulnerability: - An attacker on the network may be able to authenticate to Screen Sharing without valid credentials CVE-2026-65400 Note that Nessus has not tested for this issue...

Fedora 43 : ImageMagick (2026-63fca288d6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-63fca288d6 advisory. Update to 7.1.2.27 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Security update for dnsdist (important)

openSUSE security update: security update for dnsdist ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21533-1 Rating: important References: bsc1269201 bsc1269202 bsc1269203 bsc1269204 bsc1269205 bsc1269206 bsc1269207 Cross-References: CVE-2026-40011...

JLSEC-2026-1169 7-Zip for Windows fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive

7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named ':Zone.Identifier:$DATA' is not matched...

CVE-2026-17784 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-17656 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-71310

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

[SECURITY] [DLA 4719-1] p7zip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4719-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler August 05, 2026 https://wiki.debian.org/LTS -...

CLSA-2026-1785957662 TuxCare security update for org.springframework (7 CVEs)

TuxCare rebuilt 23 org.springframework packages to address 7 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.7...

[SECURITY] [DLA 4718-1] 7zip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4718-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler August 05, 2026 https://wiki.debian.org/LTS -...

CVE-2026-20272

Technical details about CVE-2026-20272 are not provided in the supplied documents. Cisco IOS XE hardening releases address vulnerabilities but no specifics on affected components, versions, impact, or fixes are included here. Monitor for updates.

CVE-2026-13477

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input...

Security update for php7

This update for php7 fixes the following issues: CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. CVE-2026-9672: security issues in libgd bsc1273078. CVE-2026-17543: improper escaping of backslashes in user-provided...

CVE-2026-11920

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

MINI-XVMW-77MM-5P67

Bulletin has no description...

EUVD-2026-53176

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-5116 Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-5116

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...