Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been addressed through improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4, and iPadOS 14.4. A remote attacker may be able to execute arbitrary code. Apple is aware of a report indicating...

CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CLSA-2026-1783213286 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 11.2.14-tuxcare.8...

CLSA-2026-1783126871 TuxCare security update for @angular (13 CVEs)

TuxCare rebuilt 17 @angular packages to address 13 CVEs. Fixed in 11.2.11-tuxcare.3...

CLSA-2026-1781657706 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 11.2.11-tuxcare.2...

CLSA-2026-1781052756 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 11.2.14-tuxcare.6...

CLSA-2026-1775176160 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 17 @angular packages to address 1 CVE. Fixed in 11.2.14-tuxcare.3...

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

Important: Red Hat Security Advisory: RHACS 4.11.2 security and bug fix update

Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...

CVE-2026-65454

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

CVE-2026-61424 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE...

CVE-2026-15265 Tenable Agent Path Traversal Leading to Remote Code Execution

A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote code execution...

CVE-2026-56014

Unauthenticated Cross Site Scripting XSS in Master Slider = 3.11.2 versions...

CVE-2026-54822

Subscriber SQL Injection in SALESmanago & Leadoo = 3.11.2 versions...

PT-2026-52411

Subscriber SQL Injection in SALESmanago & Leadoo = 3.11.2 versions...

CVE-2026-22342 WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

Unauthenticated Cross Site Request Forgery CSRF in WordPress Dating Theme = 11.2.0 versions...

PT-2026-50292

Unauthenticated Cross Site Request Forgery CSRF in WordPress Dating Theme = 11.2.0 versions...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, or 12.1.x. It is, therefore, affected by a vulnerability. A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS software allows an...

EUVD-2026-31913

Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the isgreaterthan or islessthan operators, user-supplied values in the values...

Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare

Drupal has issued an alert stating that it intends to release a "core security release" for all supported branches on May 20, 2026, from 5-9 p.m. UTC. "The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days," the...