WordPress Music Store plugin < 1.4.5 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by nobody in WordPress Plugin Music Store versions 1.4.5...

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure vulnerability

Unauthenticated Password Hash and Arbitrary Metadata Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin JetFormBuilder versions 3.6.5.2...

CVE-2026-14296

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-84732

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow...

CVE-2026-84732

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow...

EUVD-2026-72302

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow...

CVE-2026-84732

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow...

CVE-2026-84732

OpenVPN 2.x (through 2.6.22 and 2.7.6 ) is vulnerable to a denial of service in the control channel reliability layer, caused by a timeout integer overflow triggered by crafted ACK packet ID retransmissions. Attackers can either drive the reliable TLS retransmission timeout to grow without bound ...

CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-14296 nRF54H20: MCUBoot can be tricked to executing unauthenticated code

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

CVE-2026-14296

CVE-2026-14296 affects MCUBoot in its bare (upstream) configuration on the nRF54H20 SoC. When using the Direct XIP update strategy, the main application image can start other cores (e.g., the radio core) by providing an address from an unauthenticated slot, because MCUboot may select different sl...

EUVD-2026-72297

When using the Direct XIP update strategy, the main application image starts other cores i.e. radio core, based on the currently active slot without additional verification. The MCUboot in the bare upstream configuration assumes that if there is at least a single slot for each image available, th...

WordPress HivePress Authentication plugin <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator vulnerability

Unauthenticated Authentication Bypass via 'accesstoken' Parameter to Facebook Authenticator vulnerability discovered by Mutantgun in WordPress Plugin HivePress Authentication versions = 1.1.4...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20.1+1 August 2026 CSPU. CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access to a subset of accessible data bsc1275777. CVE-2026-61308:...

WordPress MemberDash plugin <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter vulnerability

Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter vulnerability discovered by Foxyyy in WordPress Plugin memberdash versions = 1.8.5...

SUSE-SU-2026:3998-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Update to version jdk8u504 icedtea 3.40.1. - CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access to sensitive data bsc1275777. - CVE-2026-61308: unauthenticated attacker...

Exploit for CVE-2026-67276

CVE-2026-67276 - MikroTrik SSH Authentication Bypass Exploit...

WordPress Otter Blocks plugin <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass vulnerability

Missing Authorization to Unauthenticated Purchase Verification Bypass vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Otter - Gutenberg Block versions = 3.1.7...

WordPress Masteriyo LMS plugin <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion vulnerability discovered by Jamshed Yergashvoyev CVE Guy - Turan Security in WordPress Plugin Masteriyo - LMS versions = 2.2.0...