OESA-2026-4361 gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 also known as PGP. GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories. Security Fixes: gpgtar ...

OESA-2026-4360 gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 also known as PGP. GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories. Security Fixes: gpgtar ...

Exploit for CVE-2026-79983

CVE-2026-79983 — camel-ftp: consumer builds the remote path fr...

CVE-2021-41773

CVE-2021-41773 Vulnerable service Installation Several options: 1. Docker container docker run -d -p 8080:80 12345qwert123456/apache2449cve-2021-41773 2. Dockerfile git clone https://github.com/12345qwert123456/CVE-2021-41773.git cd CVE-2021-41773-Vulnerable-service/2.4.49 docker build -t...

CVE-2026-97205

A flaw was found in NGINX. In certain configurations using asynchronous file I/O and SSI pages with include virtual commands, request processing can access freed memory in a worker process. A remote attacker may trigger memory corruption or a worker crash. Arbitrary code execution may be possible...

CVE-2026-18143

CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbitrary File Upload Python 3 PoC for CVE-2026-18143 in Request a Quote for WooCommerce woocommerce-request-a-quote, Addify / WooCommerce.com. Description PoCbit / GitHub CVE-2026-18143 — Request a Quote for WooCommerce ≤ 2.9.2 allows...

WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin Advanced File Manager versions = 5.4.14...

Exploit for CVE-2026-78163

CVE-2026-78163 — camel-docling: unvalidated body input source...

CVE-2026-111311

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

Kwetsbaarheid verholpen in BeyondTrust Remote Support

BeyondTrust has discovered a critical vulnerability in BeyondTrust Remote Support. This vulnerability, identified as CVE-2026-102764, has a CVSS score of 9.3. It involves insufficient validation of the origin of messages within the product’s internal components. As a result, a malicious actor...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-86420: Denial of Service due to memory budget exhaustion bsc1279696. CVE-2026-86421: Denial of Service via memory leak in MSL decoder bsc1279711. CVE-2026-86423: Denial of service via heap-use-after-free in PerlMagick's GetList meth...

EUVD-2026-102820

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

CVE-2026-111311

The DoubleScale | All-in-One CRM plugin for WordPress (versions up to and including 1.5.1 ) is vulnerable to Arbitrary File Upload via the store_upload function. The root cause is a fail-open extension allow-list in extension_is_allowed() which returns true when wp_check_filetype() yields an empt...

CVE-2026-111311 DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

CVE-2026-75903

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippe...

WordPress DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by wachirapong kamphapong wachiss in WordPress Plugin DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More versions = 1.5.1...

CVE-2026-92553

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitizefilename does not...

CVE-2026-74923

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed...

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-nexus cyber espionage group tracked as Armory Castle previously UNC5221 or Warp Panda exploited a newly disclosed security flaw in BeyondTrust Remote Support formerly Bomgar as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 CVSS score: 9.3, is a case of...

CVE-2026-104715 Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into moun...