PT-2026-103070

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

PT-2026-103027

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

KLA91310 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A...

KLA91311 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A...

VulnCheck KEV: CVE-2026-76504

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2026:1770647876)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1770647876 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus h...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1758135826)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758135826 advisory. - Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is ma...

CentOS Linux 8 [TuxCare] Security Update: git / git-all / git-core-doc / git-credential-libsecret / etc (CENTOS-STREAM8:CLSA-2025:1749743573)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1749743573 advisory. - Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transport...

CVE-2026-90953: Exposure of Sensitive Information to an Unauthorized Actor

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...

PT-2026-103290

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...

Linux Distros Unpatched Vulnerability : CVE-2026-47566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leadin...

AlmaLinux 9.2 [TuxCare] Security Update: open-vm-tools / open-vm-tools-desktop / open-vm-tools-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1750444475)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1750444475 advisory. - VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation...

PT-2026-103093

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw exists where the application fails to verify if a selected group belongs to a specific course during the user enrollment process. An authenticated user with teacher privileges can explo...

CVE-2026-102129: Incorrect Privilege Assignment

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...

CentOS Linux 8 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS-STREAM8:CLSA-2025:1757663410)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1757663410 advisory. - Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operation...

CVE-2026-103470: Incorrect Privilege Assignment

In Internet2 Grouper before 7.5.1 in some configurations, a user who is allowed to create or edit rules in the User Interface can escalate privileges...

PT-2026-103351

In Internet2 Grouper before 7.5.1 in some configurations, a user who is allowed to create or edit rules in the User Interface can escalate privileges...

CVE-2026-97150: Inclusion of Functionality from Untrusted Control Sphere

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

PT-2026-103123

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

PT-2026-102962

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app user login model.php::cekUserLogin of the file application/models/app user login model.php of the component KCFinder File Manager. Such...