GHSA-27MG-GQCR-W5X5 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-7JCF-W576-JVJ3 vulnerabilities

Vulnerabilities for packages: firefox...

CVE-2026-12133

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check in the joomsportseasongroupdel AJAX handler, which only...

CVE-2026-14191

An out-of-bounds heap write exists in the RAR5 recovery-volume .rev parser in WinRAR and UnRAR RecVolumes5::ReadHeader in recvol5.cpp. The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated again...

EUVD-2026-40869

An out-of-bounds heap write exists in the RAR5 recovery-volume .rev parser in WinRAR and UnRAR RecVolumes5::ReadHeader in recvol5.cpp. The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated again...

CVE-2026-12505 affecting package cifs-utils for versions less than 7.6-1

CVE-2026-12505 affecting package cifs-utils for versions less than 7.6-1. An upgraded version of the package is available that resolves this issue...

PT-2026-54705

Name of the Vulnerable Software and Affected Versions ClamAV affected versions not specified Description A flaw in the 7z file format parser allows an unauthenticated remote attacker to cause a Denial of Service DoS condition. The issue stems from improper boundary checks for content in 7z files...

WordPress WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin <= 7.11 - Authenticated (Administrator+) OS Command Injection vulnerability

Authenticated Administrator+ OS Command Injection vulnerability discovered by Irwan Kusuma - wanjay in WordPress Plugin WP Database Backup versions = 7.11...

Security update for cadvisor (important)

openSUSE Security Update: Security update for cadvisor Announcement ID: openSUSE-SU-2026:0224-1 Rating: important References: 1257429 1260305 1266645 1267788 Cross-References: CVE-2024-45310 CVE-2026-10722 CVE-2026-33186 CVE-2026-39821 CVSS scores: CVE-2024-45310 SUSE: 3.6...

PT-2026-54854

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-51 ImageMagick versions prior to 7.1.2-26 Description A missing depth check in the MVG decoder can lead to a stack overflow when the software processes a specially crafted image. A stack overflow occurs whe...

PT-2026-54856

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 Description Incorrect handling of arguments in the JP2 encoder can lead to a heap buffer over-write. A heap buffer over-write occurs when a program writes more data to a heap-allocated memory buffer than ...

Oracle Linux 7 : firefox (ELSA-2026-24983)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-24983 advisory. - Update to 140.10.2 ESR Orabug: 39534787CVE-2026-8090CVE-2026-8092 CVE-2026-8094 - Update to 140.10.1 ESR Orabug: 39481850CVE-2026-7320CVE-2026-7321...

Oracle Linux 7 : firefox (ELSA-2026-26551)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-26551 advisory. - Update to 140.10.2 ESR Orabug: 39534787CVE-2026-8090CVE-2026-8092 CVE-2026-8094 - Update to 140.10.1 ESR Orabug: 39481850CVE-2026-7320CVE-2026-7321...

Oracle Linux 7 : freerdp (ELSA-2026-20546)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20546 advisory. - Fixed CVE-2026-25952 CVE-2026-26986 CVE-2026-27951 CVE-2026-29775 CVE-2026-31883 CVE-2026-31884 CVE-2026-31885 CVE-2026-33985 Orabug: 39440279 - Fix...

The vulnerability of 7-Zip, related to the breach of data protection mechanisms, allows attackers to circumvent existing security measures and perform spear-phishing attacks.

The vulnerability of 7-Zip refers to a flaw in the data protection mechanism implemented by Mark of the Web MOTW. Exploiting this vulnerability allows attackers to bypass existing security measures and perform spear-phishing attacks...

EUVD-2026-40378

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability...

Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality

Impact An unauthenticated remote attacker can trigger unbounded memory growth on the timestamp authority server. This vulnerability exists because the global wrapMetrics middleware records the raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency a...

CVE-2026-48286

Adobe Campaign Classic ACC versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-48286

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability (CWE-863) that could permit arbitrary code execution in the context of the current user. Exploitation does not require user interaction, and the impact is limited to the use...

WordPress Trendy Travel theme <= 6.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Trendy Travel versions = 6.8...