CVE-2026-15368 Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

CVE-2026-15368

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

EUVD-2026-51717

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

Security Bulletin: IBM Storage Protect for Space Management is affected by weaker than expected security in IBM WebSphere Application Server Liberty (CVE-2025-14917)

Summary IBM Storage Protect for Space Management uses IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings. IBM Storage Protect...

Oracle Linux 8 : pki-deps:10.6 (ELSA-2026-43218)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-43218 advisory. - Resolves: CVE-2015-5262 - Resolves: CVE-2014-3577 - Resolves: rhbz1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in...

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

GHSA-VCCV-CMXP-4J9H sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

CVE-2026-16503

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16504

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

CVE-2026-16504 VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

CVE-2026-16504 VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

CVE-2026-16504

The VPS.org one-click Zulip template contains multiple vulnerabilities due to the use of static templates without per-deployment randomization. Specifically, the template deploys with a hardcoded application signing key (secret_key: changeme ), a default database password (zulip ), and the config...

EUVD-2026-51548

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16503

The VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432 ) using the default password "postgres" . Because Docker manages its own iptables rules, this configuration bypasses standard host UFW firewall protections. A remote attacker ca...

EUVD-2026-51547

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-10079

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

CVE-2026-10079 Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causi...

CVE-2026-65310

CVE-2026-65310 affects ANDRITZ HIPASE-250 (formerly 250 SCALA). In default configurations, the product exposes its data and configuration endpoint without authentication and with permissive CORS on every response. An unauthenticated attacker with network access can read live process values and se...