CVE-2026-41079 affecting package cups for versions less than 2.4.18-1

CVE-2026-41079 affecting package cups for versions less than 2.4.18-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-34304 affecting package mysql for versions less than 8.0.46-1

CVE-2026-34304 affecting package mysql for versions less than 8.0.46-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-34267 affecting package mysql for versions less than 8.0.46-1

CVE-2026-34267 affecting package mysql for versions less than 8.0.46-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-22009 affecting package mysql for versions less than 8.0.46-1

CVE-2026-22009 affecting package mysql for versions less than 8.0.46-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-63652 affecting package fluent-bit for versions less than 3.1.10-6

CVE-2025-63652 affecting package fluent-bit for versions less than 3.1.10-6. A patched version of the package is available...

CVE-2026-22004 affecting package mysql for versions less than 8.0.46-1

CVE-2026-22004 affecting package mysql for versions less than 8.0.46-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-34276 affecting package mysql for versions less than 8.0.46-1

CVE-2026-34276 affecting package mysql for versions less than 8.0.46-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-34303 affecting package mysql for versions less than 8.0.46-1

CVE-2026-34303 affecting package mysql for versions less than 8.0.46-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-22002 affecting package mysql for versions less than 8.0.46-1

CVE-2026-22002 affecting package mysql for versions less than 8.0.46-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-34270 affecting package mysql for versions less than 8.0.46-1

CVE-2026-34270 affecting package mysql for versions less than 8.0.46-1. An upgraded version of the package is available that resolves this issue...

WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme AI Lab versions 5.4.2...

CVE-2026-22336

CVE-2026-22336 affects the WordPress plugin Directorist Booking. It exposes an unauthenticated SQL Injection in versions up to 2.4.1, arising from improper neutralization of input used in SQL commands. Impact per sources is high: potential data disclosure or manipulation with no user interaction ...

Microsoft Edge (Chromium) < 147.0.3912.86 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 147.0.3912.86. It is, therefore, affected by multiple vulnerabilities as referenced in the April 24, 2026 advisory. - Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who ha...

NPM: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

NPM: PostCSS has XSS via Unescaped in its CSS Stringify Output vulnerability discovered by ? in WordPress Npm postcss versions 8.5.10...

WordPress HT Mega plugin < 3.0.7 - Unauthenticated PII Disclosure vulnerability

Unauthenticated PII Disclosure vulnerability discovered by Chiao-Lin Yu Steven Meow in WordPress Plugin HT Mega versions 3.0.7...

nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

In versions middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself for example, frontend customers sharing the web guard with the Nova admin area. The endpoint also...

CVE-2026-41062

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for objects/aVideoEncoderReceiveImage.json.php only checks the URL path component via parseurl$url, PHPURLPATH for .. sequences. However, the downstream function...

EUVD-2026-24541

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for objects/aVideoEncoderReceiveImage.json.php only checks the URL path component via parseurl$url, PHPURLPATH for .. sequences. However, the downstream function...

CVE-2026-41056 AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover

WWBN AVideo is an open source video platform. In versions 29.0 and below, the allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both...

CVE-2026-34990 affecting package cups for versions less than 2.4.17-1

CVE-2026-34990 affecting package cups for versions less than 2.4.17-1. An upgraded version of the package is available that resolves this issue...