CVE-2026-14222

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14222 Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14222

The CVE covers Easy Appointments for WordPress up to version 3.12.26, where one of the connection-deletion actions does not enforce capability or nonce checks. This lack of authorization allows users with contributor-level access to delete the booking configuration and disable the booking system....

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service. Mitigation To mitigate this issue, restrict network access to TC...

PT-2026-66381

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

EUVD-2026-43705

Easy!Appointments disablebookingmessage rendered as raw HTML on public booking page — Stored XSS...

CVE-2026-55995

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable. Mitigation If the iSNS service is not actively used...

CVE-2026-23904 Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...

Oracle Linux 8 : firefox (ELSA-2026-47105)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-47105 advisory. 140.13.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 140.13.0 -...

kernel security update

6.12.0-211.39.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091

An advisory for this issue has been issued at https://www.drupal.org/sa-contrib-2026-110 and an additional issue was identified and fixed via https://www.drupal.org/sa-contrib-2026-111 This module is now resupported. See that advisory for more details. Original content The security team is markin...

CVE-2026-18047

A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still...

CVE-2026-59922

A flaw was found in Mistune, a Python Markdown parser. A remote attacker could exploit this vulnerability by providing specially crafted input containing specific marker pairs tilde, equals-sign, or caret. This crafted input causes the parser to perform quadratic work, leading to excessive CPU...

kernel security update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

CVE-2026-32665

A flaw was found in Unbound when DNS-over-QUIC DoQ is enabled. An attacker could exploit improper validation of client-provided data length, leading to excessive memory allocation. This can cause the system to exceed its configured memory limits for QUIC connections, resulting in a Denial of...

CVE-2026-47086

A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by minting a URLAUTH token through the GENURLAUTH command. This allows bypassing Access Control Lists ACLs, which are rules that control access to mailboxes. Consequently, an attacker could read mail from any...

UBUNTU-CVE-2026-64528

In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged 1. When console flow control is enabled UPFCONSFLOW, s3c24xxserialstoptx calls...

CVE-2026-64214

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...

UBUNTU-CVE-2026-64214

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...

SUSE CVE-2026-64476

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...