CLEANSTART-2026-ZX66437 Security fixes in cadvisor 0.60.5-r0

Package cadvisor version 0.60.5-r0 fixes 2 vulnerabilities: ghsa-259r-337f-4rfw, ghsa-hrxh-6v49-42gf...

CLSA-2026-1788248501 TuxCare security update for 30 packages (1 CVE)

TuxCare rebuilt 30 packages to address 1 CVE. Fixed in 7.0.70-tuxcare.2...

CVE-2026-84479: Authentication Bypass by Spoofing

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...

CVE-2026-82228

SiteGround Security WordPress plugin versions ≤ 1.6.6 are affected by an unauthenticated 2FA Bypass vulnerability, discovered by Ananda Dhakal via Patchstack. The flaw allows a network-based attacker (with high attack complexity, no prior privileges or user interaction) to bypass two-factor authe...

CVE-2026-82228 WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability

Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

ROOT-OS-DEBIAN-13-CVE-2026-23069 CVE-2026-23069 in linux - Patched by Root

Root has patched CVE-2026-23069 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2022-1247 CVE-2022-1247 in linux - Patched by Root

Root has patched CVE-2022-1247 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-53106 CVE-2026-53106 in linux - Patched by Root

Root has patched CVE-2026-53106 in the linux package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-82643: Improper Restriction of Excessive Authentication Attempts

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustaine...

Linux Distros Unpatched Vulnerability : CVE-2026-82470

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp...

CVE-2026-82470

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

CVE-2026-82470 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...

EUVD-2026-42698

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass...

EUVD-2026-42995

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint...

EUVD-2026-43000

Snipe-IT has a path traversal vulnerability via CSV import image field...

WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SiteGround Security versions = 1.6.6...

CVE-2026-18918

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a...

CVE-2026-18918

Eclipse Lyo versions 2.0.0 through 7.0.0 are affected by an OAuth 1.0 authorization bypass in the 2-legged authentication path. Applications relying on Lyo's AbstractAdapterCredentialsFilter are vulnerable because an unauthenticated attacker can register a provisional trusted client and immediate...