CVE-2026-69093

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

Exploit for CVE-2026-64560

CVE-2026-64560 — Linux Kernel posix-cpu-timers Non-leader exec...

WordPress WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce plugin <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation vulnerability

Authenticated Shop Manager+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPify Woo Czech versions = 5.4.16...

CVE-2026-18599

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.setconfig of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument recordsize causes command injection. The exploit has been published...

EUVD-2026-52264

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.setconfig of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument recordsize causes command injection. The exploit has been published...

WordPress Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion vulnerability

Authenticated Subscriber+ Path Traversal to Arbitrary CSS/JS File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Nexter Blocks versions = 5.0.0...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the OnePassSignatures.verify method of OpenPGPMessageInputStream, whose catch PGPSignatureException block for the dataSignature.sanitizekey, policy check contains only a // continue...

UBUNTU-CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-13506

CVE-2026-13506 affects multiple Bouncy Castle for Java lines: Java mainline prior to 1.85; Java LTS prior to 2.73.12; and Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.x), 2.0.2 (2.0.x), and 2.1.3 (2.1.x). Root cause is a Lazy ASN.1 sequence that resets the nesting-depth guard, with potential im...

CVE-2026-58062

CVE-2026-58062 affects Bouncy Castle for Java prior to 1.85, including LTS prior to 2.73.12, and BC-FJA prior to bc-fips 2.0.2 (2.0.x) and 2.1.3 (2.1.x). The issue: Stapled OCSP responses are accepted without binding to the checked certificate, enabling potential information disclosure or integri...

UBUNTU-CVE-2026-59643

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-59649 OpenPGP user-attribute subpacket length bounded only by JVM max memory

In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 1.0.13 1.0.X series, 2.0.13 2.0.X series and 2.1.13 2.1.X serie...

CVE-2026-59652

CVE-2026-59652 affects Bouncy Castle for Java prior to 1.85, where LDAP filter injection can occur via the legacy jdk1.4 LDAPStoreHelper. The vulnerability is linked to the LDAP filter handling in that component. The provided sources do not detail exploits or exploitation status; no working explo...

CVE-2026-15055

CVE-2026-15055 affects Bouncy Castle for Java (before 1.85), LTS (before 2.73.12), and BC-FJA (before bcpkix-fips 1.0.12 / 2.0.12 / 2.1.12). The PKCS#8 / PBES2 decryptors honour an unbounded KDF cost parameter from the input, enabling a denial-of-service attack by supplying a key with an excessiv...

EUVD-2026-52012

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution...

PT-2026-67020

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.85 Bouncy Castle for Java LTS versions prior to 2.73.12 Description RSA PKCS1 verification skips the last two hash bytes when using the NULL-omitted path. Recommendations Update Bouncy Castle for Java...

Fedora 45 : docker-buildkit (2026-26c0a0ee30)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-26c0a0ee30 advisory. Automatic update for docker-buildkit-0.32.1-1.fc45. Changelog Mon Aug 3 2026 Bradley G Smith - 0.32.1-1 - Update to release v0.32.1 - Upstream fixes...

PT-2026-67028

The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs such as an Author once granted upload access to store a script-bearing file tha...

PT-2026-67414

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...