Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.1.9 Vulnerability Details CVEID:CVE-2026-54058 DESCRIPTION: Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path,...

WordPress Appointment Hour Booking plugin < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability

Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability discovered by Researcher1: Alessandro Greco aka Aleff; Researcher2: Giovambattista Ianni; Company/Organization: University of Calabria UNICAL in WordPress Plugin Appointment Hour Booking versions 1.5.88...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-12587

CVE-2026-12587 affects the Virtuagym application, where a static, hard-coded badge_number parameter is used as the HMAC private key for generating physical access QR codes. This value is exposed via the API endpoint /club/_id_club_/member/_id_member_/resamania_qr_info, and the cryptographic logic...

CVE-2026-12587 Embedded credentials in Virtuagym

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

WordPress Formidable Forms plugin <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'frmuserid' Parameter vulnerability discovered by daroo in WordPress Plugin Formidable Forms versions = 6.33.1...

Exploit for Code Injection in Pgadmin Pgadmin_4

CVE-2025-2945 — pgAdmin 4 Authenticated Query Tool RCE CVSS...

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

The CERT Coordination Center CERT/CC has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912 , both stem...

Exploit for CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-...

WordPress Forminator Forms plugin <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter vulnerability

Unauthenticated DOM-Based Cross-Site Scripting via 'errordescription' Parameter vulnerability discovered by Adrien Brunner in WordPress Plugin Forminator versions = 1.57.0...

CVE-2026-80204

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort...

SUSE-SU-2026:3810-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert 'scsi: qla2xxx: Perform lockless command completion in...

SUSE-SU-2026:3809-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. - CVE-2026-23204: net: add skbheaderpointercareful helper bsc1258340. - CVE-2026-52986: netfilter:...

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. CVE-2026-23204: net: add skbheaderpointercareful helper bsc1258340. CVE-2026-52986: netfilter:...

CVE-2026-80204

CVE-2026-80204 affects the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 . The root cause lies in the injectSecurityTab() function of BlueprintController, which performs raw isSuperAdmin()/hasPermission() checks without a request parameter, preventing enforcement of scopeAllows(). As a ...

CVE-2026-80204 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80204 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

Exploit for CVE-2026-76904

GeoServer WFS Inventory und autorisierte Verifikation Dieses...

CVE-2026-80349

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...