[SECURITY] [DSA 6544-1] sabnzbdplus security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6544-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...

CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

Debian dsa-6544 : sabnzbdplus - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6544 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6544-1 [email protected] https://www.debian.org/security/ Moritz...

CVE-2026-100273

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution...

CVE-2026-100273

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution...

CVE-2026-100273

In JetBrains YouTrack versions prior to 2026.2.19197 , an authorisation bypass exists within the scripts debugger . This flaw allows an attacker to achieve arbitrary code execution . Exploitation details are not provided in the documents.

EUVD-2026-90017

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution...

PT-2026-103320

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19197 Description An authorization bypass in the scripts debugger allows for arbitrary code execution. Recommendations Update to version 2026.2.19197...

CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

Debian dla-4767 : keystone - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4767 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4767-1 [email protected]...

[SECURITY] [DLA 4767-1] keystone security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4767-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 02, 2026 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 6480-1] keystone security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6480-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 01, 2026 https://www.debian.org/security/faq -...

Debian dsa-6480 : keystone - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6480 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6480-1 [email protected] https://www.debian.org/securit...

Debian dla-4043 : openjdk-17-dbg - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4043 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4043-1 [email protected] https://www.debian.org/lts/security/...

[SECURITY] [DSA 5857-1] openjdk-17 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5857-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 03, 2025 https://www.debian.org/security/faq -...

CVE-2023-6384 WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR

The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar...

USN-6492-1 mosquitto vulnerabilities

Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2021-34431...

CMS Commander < 2.288 - Unauthenticated Authorisation Bypass

The plugin does not use a sufficient unique cryptographic signature in its cmscaddsite feature, which could allow unauthenticated users to update the cmscpublickey settings when the plugin has not been configured yet, and get access to the plugin's remote control features such as creating an...

CVE-2023-2179 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making...