Araxis Merge

RISK EVALUATION Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative user could retrieve and unencrypt other users'...

CVE-2026-77798

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

CVE-2026-97061

Versions of Black Candy up to and including 3.2.1 are vulnerable to an information disclosure flaw. The application fails to scope playlist search queries to the currently authenticated session user. Consequently, any authenticated user can query the SearchController or Search::PlaylistsControlle...

CVE-2026-77798 Velociraptor Authenticated Denial of Service

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

CVE-2026-77798 Velociraptor Authenticated Denial of Service

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

EUVD-2026-85882

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

CVE-2026-77798 Velociraptor Authenticated Denial of Service

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module...

CVE-2026-77798

The Velociraptor software contains a deadlock condition within its user management module . This issue is caused by a lock management bug and can be triggered by authenticated users . The primary impact is a high availability risk, potentially leading to a denial of service . No specific patch ve...

CVE-2026-61819

A flaw was found in pgpartman. A database user with partmanuser privileges can exploit a SQL injection vulnerability by crafting a malicious parent-table name. When the extension is configured to use pgjobmon, this crafted input is improperly processed during an exception, allowing the injection...

CVE-2026-78310

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78310

The software DIAEnergie (versions before 1.11.00.022 ) is vulnerable to an Authorization Bypass caused by a user-controlled key . While the specific technical root cause and component are not detailed in the provided documents, the vulnerability allows for unauthorized access. No specific exploit...

EUVD-2026-85821

Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.4.0 - Subscriber+ Cross-User Account Takeover vulnerability

Subscriber+ Cross-User Account Takeover vulnerability discovered by vuxvinh in WordPress Plugin WP OAuth Server versions 6.4.0...

CVE-2026-93662

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

CVE-2026-88847

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to...

CVE-2026-88845

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

CVE-2026-82850

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-82849

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

kernel-rt security, bug fix, and enhancement update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

EUVD-2026-85809

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...