CVE-2026-91119

The open-source discussion platform Discourse is vulnerable to stored HTML injection in versions prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0. The small-action and nested-activity-log components fail to perform URL encoding when interpolating the free-form action_code_who value into mentio...

EUVD-2026-86307

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-91119 Discourse: Encode action_code_who in mention URLs

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-91119 Discourse: Encode action_code_who in mention URLs

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-91119 Discourse: Encode action_code_who in mention URLs

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

Google’s location data privacy failures draw a €403 million fine

The Irish Data Protection Commission DPC has fined Google €403 million $459 million for violating European privacy law. The penalty follows a six-year inquiry into Google’s management of user location data between May 2018 and February 2020. During that time, Google collected users’ location data...

CVE-2026-82849

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

EUVD-2026-85798

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

CVE-2026-91119: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

PT-2026-97709

Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions prior to 3.4.2 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if the authenticated user requesting course-progress records is the actual owner of those records. This allows...

PT-2026-98202

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description The topic small-action and nested-activity-log components interpolate the free-form...

Linux Distros Unpatched Vulnerability : CVE-2026-66069

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets...

CVE-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

WordPress: Information Disclosure - Unauthen Leak Private Content

A vulnerability was discovered in the BuddyPress integration of a forum plugin where the hidesitewide flag for new topic and reply activity was computed by checking only the posting forum's own status, not its parent forums. This allowed topics posted in a public-status subforum nested under a...

Falco 0.45.0

Sysdig Falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco...

CVE-2026-52821 Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/project and /en/admin/project/create/customer require only the generic createactivity or createproject capability and do not verify edit access to the supplied Project or Customer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

Linux Kernel nftables: Vulnerability involving local privilege escalation after free operations; nftchainlookupbyid fails to check whether a chain is active, and CAPNETADMIN is present in any user or network namespace...

CVE-2026-88912

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

EUVD-2026-76957

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...

CVE-2026-88912

The rtMedia for WordPress, BuddyPress and bbPress plugin (versions before 4.7.12 ) is vulnerable to an IDOR (Insecure Direct Object Reference) issue. The software fails to verify ownership when changing the privacy level of an activity and its associated media, relying instead on a nonce shared w...