Astra Linux – Vulnerability in Linux 5.10

Due to a vulnerability in the iouring subsystem, it is possible for kernel memory information to be leaked to the user process. timensinstall calls currentissinglethreaded to determine whether the current process is single-threaded. However, this call does not take into account iouring’s ioworker...

Astra Linux - Vulnerability in Golang-1.19

A malicious HTTP/2 client that quickly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is limited by the http2.Server.MaxConcurrentStreams setting, resetting an ongoing request allows the attacker to create a new...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation in the Link Preview component of Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions through a crafted HTML page. Chromium security severity: Medium...

WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

CVE-2026-78317

A SQL Injection vulnerability in Delta DIAEnergie v1.11.00.002 allows a network-based attacker with low privileges to achieve remote code execution , resulting in high impact to confidentiality, integrity, and availability. The NVD-assigned CVSS 3.1 score is 8.8 (High) . No specific remediation v...

CVE-2026-78315

Delta DIAEnergie v1.11.00.002 is affected by a SQL Injection vulnerability that allows an attacker to achieve remote code execution . The CVSS 3.1 base score is 8.8 (HIGH) , with a network attack vector, low attack complexity, and low privileges required. CISA's SSVC assessment indicates no known...

EUVD-2026-64760

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution...

CVE-2026-78314 DIAEnergie - SQL Injection

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution...

BIT-COSIGN-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor...

ROOT-OS-DEBIAN-13-CVE-2025-61728 CVE-2025-61728 in golang-1.24 - Patched by Root

Root has patched CVE-2025-61728 in the golang-1.24 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-58189 CVE-2025-58189 in golang-1.24 - Patched by Root

Root has patched CVE-2025-58189 in the golang-1.24 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-61732 CVE-2025-61732 in golang-1.24 - Patched by Root

Root has patched CVE-2025-61732 in the golang-1.24 package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-78187 Piwigo Public Authentication cross site scripting

A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...

EUVD-2026-65146

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...

PT-2026-81057

Name of the Vulnerable Software and Affected Versions Toolset Blocks versions 1.6.26 and earlier Description Unauthenticated Cross-Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Toolset Blocks to...

firefox security update

140.14.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 140.14.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.14.0-1 - Update to 140.14.0 ESR...

PT-2026-80825

Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...

PT-2026-81046

Name of the Vulnerable Software and Affected Versions WooBeWoo Product Filter Pro versions prior to 3.1.9 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes t...

PT-2026-81050

Name of the Vulnerable Software and Affected Versions MagicAI for WordPress versions 1.4 and earlier Description A Local File Inclusion issue exists that allows users with Subscriber privileges to read arbitrary files on the server. Recommendations Update MagicAI for WordPress to a version later...