OESA-2026-3754 openjdk-17 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: RMI. Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9...

Navidrome <=0.54.5 - Authentication Bypass in Subsonic API

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

CVE-2021-27905

CVE-2021-27905 Apache Solr ReplicationHandler Server Side Request Forgery SSRF Hit Counter Apache Solr stands for Searching On Lucene with Replication is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and clien...

CVE-2026-82851

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

CVE-2026-88046

A flaw was found in rclone, a command-line program for syncing files. This vulnerability allows an attacker to bypass configured directory restrictions by including parent-directory segments e.g., '..' in source object names. When a specially crafted source object is uploaded or copied, it can...

CVE-2026-15823

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

WordPress Advanced Contact form 7 DB plugin <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import vulnerability

Missing Authorization to Authenticated Custom+ Unauthorized Data Import vulnerability discovered by Jiang CY in WordPress Plugin Advanced Contact form 7 DB versions = 2.1.3...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - 在线购物系统高级版中的SQL注入 摘要 在 PuneethReddyHC 的 Online Shopping System Advanced 项目中发现了一个严重的SQL注入漏洞。该漏洞存在于 action.php 中，未能正确清理来自 keyword POST参数的用户输入。攻击者可以注入恶意SQL以提取数据或篡改数据库。 技术细节 漏洞类型 ：SQL注入 受影响文件 ：action.php 参数 ：keyword（通过POST） 受影响版本 ：1.0 攻击类型 ：远程 影响 ：未经授权的数据访问、数据库操作...

CVE-2026-8615

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnectcallback function in versions up to, and including, 1.2.3. The function is registered to the...

GHSA-4MVJ-M6J5-PMF7 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-3174

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

EUVD-2026-72697

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

CVE-2026-86451 MISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects

Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::getreferencedata without first checking whether the requester is authorized to view the object the reference belongs to. The vulnerable code queried ObjectReference.uuid direct...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20.1+1 August 2026 CSPU. CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access to a subset of accessible data bsc1275777. CVE-2026-61308:...

Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Update to version jdk8u504 icedtea 3.40.1. CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access to sensitive data bsc1275777. CVE-2026-61308: unauthenticated attacker with...

EUVD-2026-57455

SiYuan: Embedded transclusion block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers...

CVE-2026-85093

Cheshire Cat AI (an open-source AI agent framework) contains an information disclosure vulnerability in its GET /memory/collections/{collection_id}/points endpoint. The root cause is a missing per-user filter when retrieving episodic memory points, allowing any authenticated user with MEMORY:READ...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)

Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions...

EUVD-2026-67934

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...