WordPress WP User Frontend plugin < 4.3.12 - Subscriber+ Post Creation vulnerability

Subscriber+ Post Creation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP User Frontend versions 4.3.12...

CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

PT-2026-104108

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

CVE-2026-104449: Authorization Bypass Through User-Controlled Key

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled idfiche...

CVE-2026-79618: Missing Authorization

The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...

PT-2026-104259

YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id fiche...

Rocky Linux 10.2 [CIQ] Security Update: dogtag-pki-debugsource / idm-pki-acme / idm-pki-base / idm-pki-ca / etc Multiple Vulnerabilities (crlsa-2026_73765)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673765 advisory. pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogta...

Joomla 1.5.x < 5.4.9 / 6.0.x < 6.1.4 Multiple Vulnerabilities (joomla-6-1-4-5-4-9-security-bugfix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 5.4.9 or 6.0.x prior to 6.1.4. It is, therefore, affected by multiple vulnerabilities. - Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controll...

Linux Distros Unpatched Vulnerability : CVE-2026-104721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path- traversal vulnerability. More specifically, an MDC-based...

CVE-2026-97662 Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

CVE-2026-97662 Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

Exploit for CVE-2026-90907

CVE-2026-90907 — Joomla! CMS Unauthorized User Account Creatio...

dogtag-pki security update

An update is available for dogtag-pki. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list IdM PKI is an enterprise software system designed to manage enterprise...

RLSA-2026:73766 Important: pki-core security update

The Public Key Infrastructure PKI Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fixes: pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-cor...

pki-core security update

An update is available for pki-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Public Key Infrastructure PKI Core contains fundamental packages require...

CVE-2026-103282 Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create...

CVE-2026-103282

Ghost versions 0.5.0 before 6.23.0 are vulnerable to a concurrency issue within the staff invitation acceptance mechanism. This race condition allows an attacker to submit multiple concurrent requests using a single invitation token to create duplicate user accounts . No specific exploit code or ...

EUVD-2026-90675

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create...

CVE-2026-103282 Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create...

Security Bulletin: Maximo AI Service uses client-java-21.0.0.jar which is vulnerable to CVE-2026-15687.

Summary Maximo AI Service uses client-java-21.0.0.jar which is vulnerable to CVE-2026-15687. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-15687 DESCRIPTION: A security issue was discovered in the Kubernetes Java client librar...