CVE-2026-71461

The Red Hat Ansible Automation Platform 2.7 Container Release is affected by CVE-2026-71461, which involves a verbose internal exception disclosure in the HostList.list() function. The component catches a bare Exception and returns the error string verbatim. An authenticated user can trigger a Dj...

CVE-2026-71461 Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

EUVD-2026-85535

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-95525

The WP User Frontend plugin for WordPress, affecting versions

EUVD-2026-85494

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

CVE-2026-95525 WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

CVE-2026-95523

The WP User Frontend plugin for WordPress, versions

EUVD-2026-85492

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95523 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95524 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95523 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95524

The WP User Frontend WordPress plugin, affecting versions

EUVD-2026-85493

Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-95524 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-94079

The WP User Manager plugin for WordPress, affecting versions

CVE-2026-94079 WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

EUVD-2026-85469

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-94079 WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-75131 NetworkManager-l2tp Privilege Escalation via pppd Username Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...

EUVD-2026-85524

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...