WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2026-42877)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42877 advisory. 1:1.8.0.502.b07-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.502.b07-1.1 - Update to 8u502-b07 GA. - Update release notes for...

CVE-2026-69113

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

EUVD-2026-56853

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113 Cap v0.3.1 Broken Access Control via video comment endpoint

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

CVE-2026-69113

Cap v0.3.1 has a broken access control flaw in POST /api/video/comment that lets an authenticated user supply any videoId to comment on private videos. Impact includes injecting comments on others’ private videos, triggering owner notification emails, and enumerating valid video IDs via response ...

CVE-2026-73155

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

CVE-2026-73140

Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...

EUVD-2026-55972

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

CVE-2026-73155

The CVE concerns cti-transmute: affected versions allow authenticated users to add or remove emoji reactions on private/inaccessible comments without checking visibility. Root cause: react() forwarded an attacker-controlled comment_id to comments_repo.toggle_reaction() after only syntactic existe...

CVE-2026-73155 cti-transmute Missing Authorization Allows Reactions to Private Comments

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

CVE-2026-73155 cti-transmute Missing Authorization Allows Reactions to Private Comments

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

CVE-2026-73155 cti-transmute Missing Authorization Allows Reactions to Private Comments

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

CVE-2026-73155

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

CVE-2026-73140

Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...

CVE-2026-73140

The CVE-2026-73140 issue affects cti-transmute: build_evaluation_report() exported evaluation reports without applying access controls to evaluation comments, allowing a user who can view a conversion to export Markdown/PDF reports containing private comments and the comment author’s name. The ro...

EUVD-2026-55970

Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...

CVE-2026-73140 cti-transmute Evaluation Report Exports Expose Private Comments and Author Information

Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and administrative privileges,...