CVE-2026-6879: Inefficient Algorithmic Complexity

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

PT-2026-65402

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch custom field function in admin/class-admin-base.php retrieving the widget id POST parameter via filter inputINPUT POST, ... and directly...

ALSA-2026:47010 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: ipv6: fix possible UAF in icmpv6rcv CVE-2026-53006 For more details about the security issues, including the impact, a CVSS score,...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue in the DOM: Navigation...

CVE-2026-15670: Improper Neutralization of Special Elements used in an SQL Command

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

gstreamer1-plugins-bad-free security update

1.26.7-2.5 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats CVE-2026-59691 Resolves: RHEL-193550...

PT-2026-65404

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

RHEL 8 : kernel-rt (RHSA-2026:47010)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47010 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements...

CVE-2026-6251: Improper Neutralization of Special Elements used in an SQL Command

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

CVE-2026-16811: Improper Neutralization of Special Elements used in an SQL Command

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-61957

Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...

CVE-2026-43723

creationtimestamp| type| source ---|---|--- 2026-07-27 23:01:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrnyt7hlpa2e 2026-07-28 04:48:38+00:00| seen| https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities20260728 2026-07-28 17:20:36+00:00|...

CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...

UBUNTU-CVE-2026-64537

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

CVE-2026-64537 bridge: cfm: reject invalid CCM interval at configuration time

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

CVE-2026-64537 bridge: cfm: reject invalid CCM interval at configuration time

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

CVE-2026-64537

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

GHSA-HRXH-6V49-42GF

creationtimestamp| type| source ---|---|--- 2026-07-27 19:48:38+00:00| seen| https://gist.github.com/allanrogerr/6d10196ab8eb0d80a2cfca871b45d9a8 2026-08-03 12:03:59+00:00| seen| https://bsky.app/profile/mfahlandt.bsky.social/post/3ms6hejb7hx2j 2026-09-20 05:20:06+00:00| seen|...

GHSA-X5VX-C2C8-M3W9

creationtimestamp| type| source ---|---|--- 2026-07-27 19:20:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmis3k5v2n...

CVE-2026-61487

creationtimestamp| type| source ---|---|--- 2026-07-27 18:03:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrni7yb6hz22 2026-07-28 14:58:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrpocvshb32e...