Linux Distros Unpatched Vulnerability : CVE-2026-92475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in GPAC 26.08-DEV. This impacts the function waitforheaderandparse of the file src/utils/downloader.c. This manipulation of the...

SUSE SLES15 Security Update : cjose (SUSE-SU-2026:4253-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4253-1 advisory. - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap- based buffer overflow...

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

The Content Delivery API enforces member / Public Access protection only at the controller layer, against the node that is directly requested. When a public unprotected node references a protected node through a Content Picker or Multi-Node Tree Picker including those nested inside Block List,...

GHSA-WR57-HQMP-FGVH Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

The Content Delivery API enforces member / Public Access protection only at the controller layer, against the node that is directly requested. When a public unprotected node references a protected node through a Content Picker or Multi-Node Tree Picker including those nested inside Block List,...

Missing Authorization

Overview Umbraco.Cms.Web.Common is a package containing the web assembly needed to run Umbraco CMS. Affected versions of this package are vulnerable to Missing Authorization in the Content Delivery API, which enforces Public Access protection only on directly requested nodes, expanding Content...

Missing Authorization

Overview Umbraco.Cms.Api.Delivery is a presentation layer for the Umbraco CMS Delivery API. Affected versions of this package are vulnerable to Missing Authorization in the Content Delivery API, which enforces Public Access protection only on directly requested nodes, expanding Content Picker and...

CVE-2026-69197

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

CVE-2026-69197 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

EUVD-2026-81902

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

CVE-2026-69197

Umbraco CMS (ASP.NET) contains an authorization bypass in the Content Delivery API prior to 13.15.1, 17.5.3, and 18.0.2 . Member and Public Access checks are applied to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, ...

CVE-2026-69197 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

CVE-2026-69197 Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

GHSA-G74Q-6G2F-874X Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

Summary @tinacms/auth's isAuthorizedreq decides authorization by validating the caller's bearer token against https://identity.tinajs.io/v2/apps/$req.query.clientID/currentUser, where the clientID comes from the request and is never compared to the site's own configured TinaCloud app id. The...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Cortex(CCx) 26.0.0-IF002 for August 2026

Summary IBM Content Cortex CCx 26.0.0-IF002 addresses CVEs across components including AI Services & tools, FDM and CPE. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 unti...

Security Bulletin: Eclipse parsson security vulnerability in IBM Content Cortex reported for BAI-EVENTS-JAVA-SDK

Summary Eclipse parsson CVE-2026-9563 security vulnerability in IBM Content Cortex. Affected and vulnerable. Vulnerability Details CVEID:CVE-2026-9563 DESCRIPTION: In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure via the printr filter in Twig templates when content sandboxing fails to restrict certain filters. An attacker can access...

Security Bulletin: Jackson databind security vulnerability in IBM Content Cortex reported for ACCE, GraphQL, External-Share

Summary Jackson databind CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518 security vulnerability in IBM Content Cortex. Affected and vulnerable Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose...

SUSE-SU-2026:4237-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...

Malicious Package

Overview language-selector-content is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-86801

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...