Astra Linux – Vulnerability in Firefox and Thunderbird

Firefox was vulnerable to a heap buffer overflow in nsTextFragment due to insufficient OOM handling. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and Firefox 121...

Astra Linux – Vulnerability in Firefox and Thunderbird

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution within the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11...

CVE-2026-18917 affecting package libvirt for versions less than 11.9.0-1

CVE-2026-18917 affecting package libvirt for versions less than 11.9.0-1. A patched version of the package is available...

WordPress Quotes llama plugin < 3.1.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Pablo González Pérez in WordPress Plugin Quotes llama versions 3.1.6...

WordPress HT Menu plugin < 1.2.7 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin HT Menu versions 1.2.7...

CVE-2026-85640

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component...

CVE-2026-77697

ManageEngine Endpoint Central (by Zohocorp) versions below 11.4.2540.23 are affected by a Privilege Escalation vulnerability during JAR extraction. The flaw allows a locally authenticated user with low privileges to escalate their permissions, with changed scope impacting the confidentiality, int...

GHSA-MVXR-6M87-MV2Q vulnerabilities

Vulnerabilities for packages: pghero, logstash, kube-logging-operator, ruby3.3-mail, pghero-fips...

CVE-2026-82631 affecting package valkey for versions less than 8.0.11-1

CVE-2026-82631 affecting package valkey for versions less than 8.0.11-1. An upgraded version of the package is available that resolves this issue...

WordPress WPFunnels plugin < 3.13.0 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Aditya Gurav in WordPress Plugin WPFunnels versions 3.13.0...

WordPress RegistrationMagic plugin < 6.0.9.9 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin RegistrationMagic versions 6.0.9.9...

WordPress Social Media Share Buttons & Social Sharing Icons plugin < 3.0.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Social Media & Share Icons versions 3.0.1...

CVE-2026-63384 affecting package mysql for versions less than 8.0.46-2

CVE-2026-63384 affecting package mysql for versions less than 8.0.46-2. A patched version of the package is available...

CVE-2026-63383 affecting package mysql for versions less than 8.0.46-2

CVE-2026-63383 affecting package mysql for versions less than 8.0.46-2. A patched version of the package is available...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.40 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.40...

WordPress User Frontend plugin < 4.3.10 - Editor+ PHP Object Injection vulnerability

Editor+ PHP Object Injection vulnerability discovered by Hijun Kim in WordPress Plugin WP User Frontend versions 4.3.10...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin < 1.26.7 - Backup Restoration vulnerability

Backup Restoration vulnerability discovered by Jashid Sany in WordPress Plugin UpdraftPlus versions 1.26.7...

WordPress Simple Google Calendar Outlook Events Widget plugin < 3.1.0 - Unauthenticated SSRF via calendar_id vulnerability

Unauthenticated SSRF via calendarid vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Simple Google Calendar Outlook Events Block Widget versions 3.1.0...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: unbound (UTSA-2026-104794)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104794 advisory. In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, stub or forward zones where the name is below an intermediate labed below a DNSSEC signed zone could be...

NPM: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

NPM: consciousness-explorer / sublinear-time-solver MCP exportstate has an arbitrary file write vulnerability discovered by ? in WordPress Npm sublinear-time-solver versions 1.6.0...