CVE-2026-16993 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...

CVE-2026-71191

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...

CVE-2026-71191

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...

EUVD-2026-53049

In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...

CLSA-2026-1784943220 TuxCare security update for immutable (1 CVE)

TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.1.0-tuxcare.3...

CLSA-2026-1784683091 TuxCare security update for immutable (1 CVE)

TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.3.7-tuxcare.2...

CLSA-2026-1784250515 TuxCare security update for lodash (2 CVEs)

TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.5-tuxcare.1...

CLSA-2026-1784250520 TuxCare security update for lodash (7 CVEs)

TuxCare rebuilt lodash to address 7 CVEs. Fixed in 4.17.11-tuxcare.1...

CLSA-2026-1781484855 TuxCare security update for form-data (8 CVEs)

TuxCare rebuilt form-data to address 8 CVEs. Fixed in 4.0.1-tuxcare.1...

CLSA-2026-1781571275 TuxCare security update for express (8 CVEs)

TuxCare rebuilt express to address 8 CVEs. Fixed in 4.18.1-tuxcare.1...

CLSA-2026-1780361406 TuxCare security update for diff (4 CVEs)

TuxCare rebuilt diff to address 4 CVEs. Fixed in 4.0.2-tuxcare.1...

CLSA-2026-1776991069 TuxCare security update for handlebars (9 CVEs)

TuxCare rebuilt handlebars to address 9 CVEs. Fixed in 4.7.9-tuxcare.1...

CLSA-2026-1776213248 TuxCare security update for io.netty (6 CVEs)

TuxCare rebuilt 46 io.netty packages to address 6 CVEs. Fixed in 4.1.82.Final-tuxcare.1...

CLSA-2026-1774398079 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.3-tuxcare.1...

CVE-2026-14939

The Visualizer WordPress plugin is affected: versions before 4.0.6 expose a vulnerability where an attacker with Contributor-level access can supply a URL that is not validated to safe address ranges, enabling server-side requests (SSRF) to link-local instance-metadata endpoints. The fetched resp...

EUVD-2026-52520

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function removeprofile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

OPENSUSE-SU-2026:11446-1 cockpit-repos-4.9-1.1 on GA media

These are all security issues fixed in the cockpit-repos-4.9-1.1 package on the GA media of openSUSE Tumbleweed...

Exploit for CVE-2025-48932

CVE-2025-48932-Invision-Community-SQLi-Exploit CVE-2025-48932...

CVE-2026-10773

The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...

CVE-2026-65981

CVE-2026-65981 affects Coturn prior to 4.15.0. A MOBILITY-TICKET–based session-resume flaw allows an authenticated attacker to bypass per-allocation authorization: a resumed REFRESH is validated against the attacker’s identity instead of the original allocation owner, enabling cross-user receipt ...