CVE-2026-89424 Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-89424 Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-89424

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.5.6 . The root cause is insufficient input sanitization and output escaping involving the 'noti_token' parameter. An authenticated attacker with Subscriber-level access (or...

CVE-2026-103282: Concurrent Execution using Shared Resource with Improper Synchronization

Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be created from a single invite token. Attackers can exploit this race condition by submitting concurrent requests with the same invitation token to create...

PT-2026-103814

Name of the Vulnerable Software and Affected Versions Ghost versions 0.5.0 through 6.22.9 Description A concurrency issue exists in the staff invitation acceptance mechanism. This race condition allows an attacker to create multiple user accounts using a single invitation token by submitting...

Rocky Linux 9 [CIQ] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (crlsa-2025_23210)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523210 advisory. keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration CVE-2025-13609 Tenable has extracted the preceding description block directly...

CVE-2026-89424: Improper Neutralization of Input During Web Page Generation

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

PT-2026-103739

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti token' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-103247: Authorization Bypass Through User-Controlled Key

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to...

Rocky Linux 10.1 [CIQ] Security Update: keylime / keylime-base / keylime-registrar / keylime-selinux / etc (crlsa-2025_23201)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523201 advisory. keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration CVE-2025-13609 Tenable has extracted the preceding description block direct...

Rocky Linux 9 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel (crlsa-2026_0422)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260422 advisory. libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy First- vs Last-Value Wins CVE-2025-14523 Tenable has extracted the preceding...

Rocky Linux 8 [CIQ] Security Update: libsoup / libsoup-debuginfo / libsoup-debugsource / libsoup-devel (crlsa-2026_0421)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260421 advisory. libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy First- vs Last-Value Wins CVE-2025-14523 Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: grub2-common / grub2-efi-aa64-modules / grub2-efi-x64 / etc (ALMALINUX9.2:CLSA-2024:1712672279)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1712672279 advisory. - An authentication bypass flaw was found in GRUB due to the way that GRUB uses the UUID of a device to search for the configuration file tha...

PT-2026-103780

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to...

Rocky Linux 10.2 [CIQ] Security Update: python-cryptography-debugsource / python3-cryptography / etc (crlsa-2026_71658)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202671658 advisory. python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVE-2026-69249 Tenable has extracted the...

Rocky Linux 10.1 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc (crlsa-2026_0423)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260423 advisory. libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy First- vs Last-Value Wins CVE-2025-14523 Tenable has extracted the preceding...

NPM: adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

NPM: adm-zip: Duplicate ZIP entry names: getEntry and extractAllTo resolve to different content vulnerability discovered by ? in WordPress Npm adm-zip versions = 0.6.0...

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...

GHSA-P634-W6R4-RJP2 adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

Summary A ZIP file can contain two entries with the identical name. adm-zip keeps both in its internal entry list, but its name-lookup table only retains the last one written. getEntryname and extractAllTo walk these two different internal structures, so they can each resolve a duplicate name to ...

RLSA-2026:71658 Important: python-cryptography security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...