USN-8604-1: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

USN-8604-1 linux-azure-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...

CVE-2026-12981

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts...

CVE-2026-12981

The CVE-2026-12981 entry concerns the CAFEHAUS API WordPress plugin (≤1.0.0). The root cause is lack of authentication/authorization when updating user passwords, enabling unauthenticated attackers to set the password for any user, including administrators, and fully take over accounts. The provi...

CVE-2026-14603

The CVE concerns the WowOptin: Next-Gen Popup Maker WordPress plugin (before 1.4.38). Affected component is the REST API endpoint, where insufficient authorization allows unauthenticated users to disable all opt-in forms and insert new template-based opt-in rows into the database. This represents...

EUVD-2026-48493

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts...

SUSE CVE-2026-15789

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

SUSE CVE-2026-15793

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-35425

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

EUVD-2026-48445

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

CVE-2026-35425

CVE-2026-35425 concerns Azure API Management (APIM) with an “Improper access control” condition that enables a network-exposed remote code execution by an authorized attacker. Affected software is APIM; the root cause is access-control weaknesses that allow code execution over the network. The pr...

CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability

...

EUVD-2026-48455

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

CVE-2026-35425

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability

...

PT-2026-64318

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

PT-2026-64201

Name of the Vulnerable Software and Affected Versions Azure API Management affected versions not specified Description Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network. Recommendations At the moment, there is no information about a...

Apache Syncope permission granting and access control issues

Apache Syncope is an open-source identity management and governance system that primarily provides features for user management, permission control, and role assignment. Apache Syncope has a security vulnerability that arises from the improper validation of authorization for users who register or...

PT-2026-64307

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description The automation jobs API contains a flaw where sensitive information is included in sent data. An authenticated user with scoped job or script read permissions can obtain...

CVE-2026-40430

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...