Juspay Technologies Composable Open-Source Payments Infrastructure input validation error vulnerability

Versions prior to 1.128.0 and 2026.10.01.0 of Juspay Technologies’ Composable Open-Source Payments Infrastructure contain an input validation error vulnerability. This vulnerability arises because the verifywebhooksource function within the Worldpayxml connector always returns true without...

WordPress Page and Post Restriction authorization issue vulnerability

WordPress Page and Post Restriction versions 1.6.1 and earlier contain an authorization vulnerability. This vulnerability arises because the paprrestrictpagepostrestapi function fails to validate a REST nonce when processing GET or HEAD REST requests. It then re-authenticates the current user via...

AlmaLinux 9.2 [TuxCare] Security Update: ansible-core / ansible-test (ALMALINUX9.2:CLSA-2026:1793373763)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793373763 advisory. - A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone...

SQLite buffer error vulnerability

Versions of SQLite prior to 3.54.0 contain a buffer error vulnerability. This vulnerability stems from a heap buffer overflow in the sqlite3changesetapply function within the session extension. By providing a specially crafted changeset, attackers can repeat table names and increase the number of...

PT-2026-133788

Name of the Vulnerable Software and Affected Versions Pistache versions 0.0.5 through 0.4.26 Description The SegmentTreeNode::sanitizeResource function in src/server/router.cc uses std::regex replace with the //+ expression to collapse consecutive slashes. When using libstdc++, a path containing...

WordPress Essential Addons for Elementor permission and access control issue vulnerability

WordPress Essential Addons for Elementor versions 6.8.7 and earlier contain a permission and access control vulnerability. This flaw stems from improper handling of the pageid parameter in the registeruser function. The post state rejection list accepts the inherit state carried by modified...

AdminNeo: version-cache array injection causes persistent denial of service

AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version parameter which PHP converts to an...

SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24437-1)

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24437-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-31731:...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1793364521)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793364521 advisory. - An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running th...

CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793362651)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793362651 advisory. - In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2qddealloc gfs2qddealloc,...

gcc security update

8.5.0-30.0.1 - Merge Oracle patches to 8.5.0-30. Oracle history: August-26-2025 Qing Zhao 8.5.0-28.0.1 - Merge Oracle patches to 8.5.0-28. March-31-2025 Jose E. Marchesi 8.5.0-26.0.1 - Merge Oracle patches to 8.5.0-26. Reviewed-by: David Faust March-11 2025 Qing Zhao 8.5.0-24.0.1 - Merge Oracle...

RHEL 9 : kernel-rt (RHSA-2026:93047)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93047 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

PT-2026-134489

Name of the Vulnerable Software and Affected Versions SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications versions prior to 3.10.3 Description An arbitrary file upload issue exists in the handle upload function. The flaw stems from a missing server-side file key...

CVE-2026-63377: fctr-id okta-ai-agent: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, POST /api/auth/setup in src/api/routers/auth.py allows an unauthenticated network attacker to create the first administrator account before the legitimate...

CVE-2026-111500: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function…

Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-119978: FlowiseAI Flowise: Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by…

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOWBUILTINDEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth...

Google Chrome Microsoft Edge Navigation XSS

The vulnerability in the Navigation function of Google Chrome and Microsoft Edge is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information and trigger a denial-of-service condition via a specially crafted HTML page...

OpenVM improper exception handling vulnerability

Versions prior to OpenVM 1.7.0, versions from 2.0.0-alpha up to 2.0.0-rc.3, and versions from 2.1.0-dev.0 up to 2.1.0-preview contain an improper exception handling vulnerability. This vulnerability arises because OpenVmHalo2Verifier.verify uses user-controlled proofData to construct the original...

Tesseract-OCR Tesseract buffer error vulnerability

A security vulnerability exists in Tesseract OCR versions 5.4.0 through 5.5.4. This vulnerability stems from the AppendLinePolygon function in src/api/pagerenderer.cpp, which accepts and destroys a left-to-right Pta accumulator owned by the caller via a parameter. As a result, linetoprtlpts and...