CVE-2026-11601 WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-11601 WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-11601

The WPCafe WordPress plugin (versions up to and including 3.0.19 ) is vulnerable to an authorization bypass because it fails to verify user permissions for specific actions. Specifically, the Email_Automation_Service_Provider::is_enable() method unconditionally returns true, leaving endpoints act...

EUVD-2026-91964

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-11601: Missing Authorization

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

PT-2026-104580

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The OAuth2 Provider PKCE enforcement is only applied to authorization requests where the response type is exactly code. Consequently, codes issued via OpenID Connect hybrid flows such as code token,...

PT-2026-104540

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.20 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This...

Privacy in Personalized AI Is a System Property, Not Just a Model Property

In personalized AI applications, such as conversational assistants and recommender systems, users interact not with models in isolation but with broader systems that access, infer, and reuse user information across components and over time. While such use of user information is integral to...

Important: Red Hat Security Advisory: Network Observability 1.12.3 for OpenShift

Network Observability 1.12 for Red Hat OpenShift. Network flows collector and monitoring solution...

CVE-2026-63446 Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows...

CVE-2026-63446 Suricata app-layer: passed flows can retain transactions, causing resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows...

CVE-2026-63446

Suricata (OISF) versions 8.0.0 through 8.0.6 are affected by a resource exhaustion flaw in the application-layer parser. The function AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard , marking only already-inspected transactions as inspected. On flows match...

CVE-2026-63448 Suricata smb: some SMB flows can cause resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, becaus...

CVE-2026-63448 Suricata smb: some SMB flows can cause resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, becaus...

CVE-2026-59969: Improper Validation of Certificate with Host Mismatch

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

PT-2026-93407

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.8.7 Apache ZooKeeper versions prior to 3.9.6 Description Quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: Fixed the logic for accounting bulk flows in order to ensure host fairness. In schcake, we keep track of the number of active bulk flows per host. This is done when running in the dst/src host fairness mode, which...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Check for the NOTREADY flag state after locking Currently, the check for the NOTREADY flag is performed before obtaining the necessary lock. This creates a possibility for race conditions when the flow is concurrently...

EUVD-2026-75781

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...