PT-2026-133571

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...

CVE-2026-112348: Themeum Kirki: Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers…

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify...

CVE-2026-63398: roostorg coop: Coop is an open source review and moderation tool from ROOST

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using kyselyUserFindByEmail, without binding the lookup to the organization in /saml/login/:orgId/callback. An attacker who administers ...

PT-2026-133475

Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify webhook source always returns true without enforced mTLS. Attackers knowing the merchant id and Worldp...

PT-2026-132437

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.2:CLSA-2026:1793314446)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793314446 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated...

Security Bulletin: Security Vulnerabilities were found in IBM WebSphere Application Server Liberty provided with IBM Security Verify Directory (CVE-2025-14923)

Summary Security Vulnerabilities were addressed in IBM WebSphere Application Server Liberty provided with IBM Security Verify Directory Vulnerability Details CVEID:CVE-2025-14923 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server...

PT-2026-127312

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify twitter callback function because after exchanging the visitor's oauth verifier for their...

Rocky Linux 9.6 [TuxCare] Security Update: grafana-pcp (ALMALINUX9.6:CLSA-2026:1793210765)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793210765 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be update...

Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1793133822)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793133822 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be update...

AlmaLinux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1793133822)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793133822 advisory. - On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113717 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113717...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113714 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113714...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113718 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113718...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113720 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113720...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113723 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113723...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113715 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113715...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113719 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113719...

Security Bulletin: IBM Verify Directory is affected by multiple vulnerabilities (CVE-2026-8639, CVE-2026-8640, CVE-2026-8642, CVE-2026-8860)

Summary Multiple vulnerabilities have been addressed in IBM Verify Directory in an update. Vulnerability Details CVEID:CVE-2026-8642 DESCRIPTION: IBM Security Verify Directory Web Application exposes debug endpoints that disclose system information including server versions and session identifier...

OESA-2026-4530 golang security update

. Security Fixes: On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return ...