Juspay Technologies Composable Open-Source Payments Infrastructure input validation error vulnerability

Versions prior to 1.128.0 and 2026.10.01.0 of Juspay Technologies’ Composable Open-Source Payments Infrastructure contain an input validation error vulnerability. This vulnerability arises because the verifywebhooksource function within the Worldpayxml connector always returns true without...

WordPress Page and Post Restriction authorization issue vulnerability

WordPress Page and Post Restriction versions 1.6.1 and earlier contain an authorization vulnerability. This vulnerability arises because the paprrestrictpagepostrestapi function fails to validate a REST nonce when processing GET or HEAD REST requests. It then re-authenticates the current user via...

AlmaLinux 9.2 [TuxCare] Security Update: ansible-core / ansible-test (ALMALINUX9.2:CLSA-2026:1793373763)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793373763 advisory. - A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone...

SQLite buffer error vulnerability

Versions of SQLite prior to 3.54.0 contain a buffer error vulnerability. This vulnerability stems from a heap buffer overflow in the sqlite3changesetapply function within the session extension. By providing a specially crafted changeset, attackers can repeat table names and increase the number of...

PT-2026-133788

Name of the Vulnerable Software and Affected Versions Pistache versions 0.0.5 through 0.4.26 Description The SegmentTreeNode::sanitizeResource function in src/server/router.cc uses std::regex replace with the //+ expression to collapse consecutive slashes. When using libstdc++, a path containing...

WordPress Essential Addons for Elementor permission and access control issue vulnerability

WordPress Essential Addons for Elementor versions 6.8.7 and earlier contain a permission and access control vulnerability. This flaw stems from improper handling of the pageid parameter in the registeruser function. The post state rejection list accepts the inherit state carried by modified...

gcc security update

8.5.0-30.0.1 - Merge Oracle patches to 8.5.0-30. Oracle history: August-26-2025 Qing Zhao 8.5.0-28.0.1 - Merge Oracle patches to 8.5.0-28. March-31-2025 Jose E. Marchesi 8.5.0-26.0.1 - Merge Oracle patches to 8.5.0-26. Reviewed-by: David Faust March-11 2025 Qing Zhao 8.5.0-24.0.1 - Merge Oracle...

AdminNeo: version-cache array injection causes persistent denial of service

AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which PHP converts to an...

RHEL 9 : kernel-rt (RHSA-2026:93047)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93047 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

Google Chrome Microsoft Edge Access Disclosure

The vulnerability in the Navigation function of Google Chrome and Microsoft Edge is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information and compromise its integrity by using a specially crafted HTML page...

Blender buffer error vulnerability

Versions prior to Blender 4.5.15 and versions prior to 5.2.3 contain a buffer error vulnerability. This vulnerability arises because the readfiledna function fails to validate the declared length of GLOB block fields when reading them; as a result, attackers can trigger heap-based out-of-bounds...

PT-2026-133747

Name of the Vulnerable Software and Affected Versions Apache Pinot versions prior to 1.6.0 Description An incorrect authorization issue exists in the single-stage query engine. When broker access control is enabled, the engine only authorizes the table specified in the FROM clause. Because the...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793333110)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793333110 advisory. - In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call dmaentryalloccheckleak under...

PT-2026-134250

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, deepExtend in src/utils.js checks property existence with the in operator and recurses into inherited built-ins reached through Object.prototype. An application must explicitly pass attacker-controlled resource...

Elixir programming language Elixir input validation error vulnerability

A security vulnerability exists in the Elixir programming language versions prior to 0.5.0 through 1.18.6, from 1.19.0-rc.0 up to 1.19.7, and from 1.20.0-rc.0 up to 1.20.5. This vulnerability stems from improper validation of the number of ports specified in input by the URI module. In...

GNU GCC buffer error vulnerability

GNU GCC contains a buffer error vulnerability. This vulnerability arises when a string that does not end with a null character is passed to the std::fromchars function in the libstdc++ library, causing an out-of-bounds read of an allocated buffer. This may result in denial of service, invalid dat...

SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24437-1)

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24437-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-31731:...

PT-2026-134463

Name of the Vulnerable Software and Affected Versions Popup Builder versions prior to 4.4.6 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to move all published popup...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1793364521)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793364521 advisory. - An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running th...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793362651)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793362651 advisory. - In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2qddealloc gfs2qddealloc,...