EUVD-2026-102923

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-85985

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-85985 MariaDB: Unauthorized file access via CONNECT engine UDFs

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...

CVE-2026-92542 affecting package moby-engine for versions less than 25.0.18-1

CVE-2026-92542 affecting package moby-engine for versions less than 25.0.18-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-93323 affecting package moby-engine for versions less than 25.0.18-1

CVE-2026-93323 affecting package moby-engine for versions less than 25.0.18-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-61801 affecting package moby-engine for versions less than 25.0.18-1

CVE-2026-61801 affecting package moby-engine for versions less than 25.0.18-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-100813

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript Engine: JIT component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2026-100814

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript Engine: JIT component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-100793

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

CVE-2026-107770

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-107770 Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

CVE-2026-107770

The Photo Engine (Media Organizer & Lightroom) plugin for WordPress (versions ¦6.5.6 ) is vulnerable to an authorization bypass due to insufficient verification of user permissions. This flaw allows unauthenticated attackers to permanently delete arbitrary media attachments using wp_delete_attach...

EUVD-2026-102787

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

Vulnerabilities in Adobe Commerce

Adobe has identified several vulnerabilities in Adobe Commerce. These vulnerabilities involve stored Cross-Site Scripting XSS, where attackers can inject malicious JavaScript code into form fields within the application. This code is executed in the victim’s browser and can perform unauthorized...

CVE-2026-107770: Missing Authorization

The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

PT-2026-115488

Name of the Vulnerable Software and Affected Versions The Photo Engine Media Organizer & Lightroom versions prior to 6.5.7 Description An authorization bypass exists because the plugin fails to properly verify user permissions before performing actions. Unauthenticated attackers can permanently...

PT-2026-115896

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset...

Red Hat: CVE-2026-85985: mariadb: MariaDB: Unauthorized file access via CONNECT engine functions

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...