CVE-2026-12376

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above enrolled in any single course to read every user's quiz attempts across the whole site, including personal data su...

CVE-2026-18206

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain like .example.com to restrict which hosts can register or update clients. Due to improper validation, the...

CVE-2026-14847

The vulnerability CVE-2026-14847 affects the Paid Membership Subscriptions WordPress plugin prior to version 3.0.7. One of the plugin’s payment-related AJAX actions does not perform capability checks or nonce validation, allowing any authenticated user with Subscriber-level access or higher to di...

CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

CVE-2026-6889

This CVE ID is rejected/not used and does not represent an active vulnerability entry.

SUSE CVE-2026-17666

Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. Chromium security severity: High...

EUVD-2026-51333

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

SUSE CVE-2026-17799

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a malicious file. Chromium security severity: Medium...

EUVD-2026-51329

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...

IBM Langflow OSS authorization issue vulnerability (CNVD-2026-31200)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to...

Security update for kronosnet (moderate)

openSUSE Security Update: Security update for kronosnet Announcement ID: openSUSE-SU-2026:0268-1 Rating: moderate References: 1257258 1271923 1271924 1271925 Cross-References: CVE-2026-15811 CVE-2026-15812 CVE-2026-15813 CVSS scores: CVE-2026-15811 SUSE: 5.8...

PT-2026-66775

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissions required was...

FreeBSD : Gitlab -- vulnerabilities (661d3db5-8bd9-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 661d3db5-8bd9-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass...

CVE-2026-66420

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

CVE-2026-56758

The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...

CVE-2026-66420

MeshCentral 1.1.21 is affected by a cross-site WebSocket hijacking vulnerability caused by an unconditional early return in CheckWebServerOriginName() in webserver.js when using self-signed certificates. This allows unauthenticated remote attackers to initiate cross-origin WebSocket connections t...

CVE-2026-66420 MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

CVE-2026-66420

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...