PT-2026-122512

Name of the Vulnerable Software and Affected Versions News Kit Addons For Elementor WordPress plugin versions prior to 1.4.8 Description An authenticated AJAX action fails to perform capability or ownership checks before updating post metadata. This allows users with subscriber-level access and...

PT-2026-122605

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3...

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2026-4040)

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.21.0.10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4040 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October whi...

PT-2026-122565

Name of the Vulnerable Software and Affected Versions WP Social Feed Gallery versions prior to 5.0.14 Description An issue in the insta-gallery component allows for the exploitation of incorrectly configured access control security levels due to missing authorization. Recommendations Update WP...

PT-2026-122606

Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8...

PT-2026-122517

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

Important: java-21-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM...

Important: java-11-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM...

SUSE CVE-2026-98997

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

Exploit for Improper Access Control in Nodejs Node.Js

node-cve-2026-58043-check Standalon...

Exploit for CVE-2026-21589

atlassian-cve-2026-21589-check Standalo...

Arbitrary Code Injection

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler...

Arbitrary Code Injection

Overview org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler...

CLSA-2026-1792795786 Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229

SECURITY UPDATE: out-of-bounds repeat stack access in Onigmo - debian/patches/CVE-2026-110264.patch: reject patterns whose range-repeat or null-check count overflows the internal ID type in include/ruby/onigmo.h, regcomp.c, regerror.c. - CVE-2026-110264 SECURITY UPDATE: wrapped jump offsets in...

CLSA-2026-1792795609 Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229

SECURITY UPDATE: out-of-bounds repeat stack access in regexps - debian/patches/CVE-2026-110264.patch: reject patterns whose range-repeat or null-check count overflows the ID type in regcomp.c - CVE-2026-110264 SECURITY UPDATE: wrapped jump offsets in compiled regexps -...

CLSA-2026-1792795468 Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229

SECURITY UPDATE: out-of-bounds repeat stack access in huge regexps - debian/patches/CVE-2026-110264.patch: reject patterns whose range repeat or null check IDs overflow in regcomp.c, regerror.c. - CVE-2026-110264 SECURITY UPDATE: wrapped jump offsets in the regexp compiler -...

CLSA-2026-1787917228 Fix of 43 CVEs

SECURITY UPDATE: crash when clearing the argument list while using it - debian/patches/CVE-2021-4166.patch: lock the argument list for ":all"; matches upstream patch 8.2.3884. - CVE-2021-4166 SECURITY UPDATE: reading past end of completion with a long line - debian/patches/CVE-2022-2343.patch:...

GHSA-FC2G-4W5P-6WHM virtualenv: Seeded files retain permissions from an older cache

Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW i...

virtualenv: Seeded files retain permissions from an older cache

Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW i...

CVE-2026-115883

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...