Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the updateloggedinuser function in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers t...

Mail Mint < 1.19.5 - Unauthenticated Email Disclosure

Mail Mint WordPress plugin 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication. id: CVE-2026-2025 info: name: Mail Mint 1.19.5 -...

Broadstreet WordPress plugin - Reflected XSS

Broadstreet WordPress plugin 1.51.8 contains a reflected XSS caused by unsanitised and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires victim interaction. id: CVE-2025-4652 info: name: Broadstreet WordPress plugin -...

Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

Astra Linux – Vulnerability in Apache2

There is a vulnerability related to HTTP response splitting in several Apache HTTP Server modules, especially on untrusted or compromised backend servers. This issue affects Apache HTTP Server versions from 2.4.66 onwards. Users are recommended to upgrade to version 2.4.67, as this version...

Astra Linux – Vulnerability in libxstream-java

XStream is a simple library for serializing objects to XML and back again. In affected versions, this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available, by manipulating the processed input stream with a Java runtime version 14 to 8. ...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free remote desktop protocol library and clients. Clients based on FreeRDP on Unix systems that use the /parallel command-line switch may read uninitialized data and send it to the server to which the client is currently connected. Server implementations based on FreeRDP are not...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. A bug was discovered in the CRI implementation of Containerd, where programs within a container can cause the Containerd daemon to consume memory indefinitely during the invocation of the ExecSync API. This can result in Containerd consuming all...

Security Bulletin: Security Vulnerability in Spring-Security affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22752)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring-Security Vulnerability Details CVEID:CVE-2026-22752 DESCRIPTION: Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects...

EUVD-2026-55243

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-32227

Apache Ranger versions prior to 2.9.0 are susceptible to an SQL Injection vulnerability in the lookup functionality . This flaw arises from the improper neutralization of special elements used in SQL commands, which could allow an attacker to insert malicious SQL statements into entry fields for ...

CVE-2026-55799

A Remote Code Execution (RCE) vulnerability exists in the GraalScriptEngineCreator component of Apache Ranger versions

CVE-2026-55814 Apache Ranger: Download APIs expose plugin data without authentication

Missing Authentication in Apache Ranger Download APIs on versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-64654

A flaw was found in GitHub CLI gh. Multiple commands within the tool fail to neutralize terminal escape sequences when displaying externally controlled content. An attacker who can influence this content can embed malicious escape sequences. These sequences are then interpreted by a user's...

CVE-2026-64653

A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...

CVE-2026-19328 aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...

[SECURITY] [DSA 6422-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6422-1 [email protected] https://www.debian.org/security/ Andres Salomon August 08, 2026 https://www.debian.org/security/faq -...

EUVD-2026-54767

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...

CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...