PT-2026-55497

Name of the Vulnerable Software and Affected Versions Ultimate Member versions prior to 2.11.5 Description The Ultimate Member plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because of insufficient input sanitization and output escaping when handling the about me...

Fedora 44 : leptonica / openqa / os-autoinst (2026-a72f110dcd)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-a72f110dcd advisory. This update includes new upstream snapshots of openQA and os-autoinst, with the usual mix of fixes and improvements. See upstream changelogs for details. For...

Fedora 43 : mysql8.4 (2026-280245e2ea)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-280245e2ea advisory. MySQL 8.4.10 Release notes: https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-10.html Upstream changelog:...

PT-2026-55583

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote attacker can send a specifically crafted message to downgrade the Transport Layer Security TLS protocol to a version that has been disabled in the server configuration. This issue involves th...

Fedora 44 : pdns (2026-f6ac0db764)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f6ac0db764 advisory. - Update to 5.0.6 - CVE-2026-42005 Security Advisory: https://doc.powerdns.com/authoritative/security-advisories/powerdns- advisory-2026-07.html Tenable has...

Ubuntu 22.04 LTS / 24.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-8497-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8497-1 advisory. It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as...

PT-2026-55658

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An HMAC ambiguity in Gitea Actions Artifacts V4 signed URLs allows for cross-repository artifact reading and cross-task upload-state writing. HMAC Hash-based Message Authentication Code is a...

kernel-devel-7.1.2-1.1 on GA media (moderate)

kernel-devel-7.1.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11175-1 Rating: moderate Cross-References: CVE-2026-45866 CVE-2026-52946 CVE-2026-53325 CVE-2026-53354 CVSS scores: CVE-2026-45866 SUSE : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2026-45866 SUSE : 7.3...

Fedora 44 : mysql8.4 (2026-8c7f5e32c5)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8c7f5e32c5 advisory. MySQL 8.4.10 Release notes: https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-10.html Upstream changelog:...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : HPLIP vulnerabilities (USN-8483-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8483-1 advisory. It was discovered that HPLIP incorrectly handled certain print data. An attacker could possibly use this issue to cause...

Oracle Linux 8 : php:7.4 (ELSA-2026-34354)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-34354 advisory. - Fix XSS within status endpoint CVE-2026-6735 - Fix Stale SOAPGLOBALrefmap pointer with Apache Map CVE-2026-6722 - Fix Use-after-free after header...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the archivewritezipheader function when ZIP encryption is enabled and the entry file size is close to INT64MAX. An attacker can cause undefined behavior, such as incorrect Zip64 extension decisions or a...

Zebra: Finalized address balance credit-first overflow on consensus-valid blocks

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node processes blocks on any Zcash network. Summary The finalized transparent address balance writer processes all newly-created outputs credits before processing spent outputs debits within the same block. A...

Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections and is syncing or catching up to the chain tip. Summary A malicious peer can answer Zebra's outbound getblocks/FindBlocks request with a small two-hash inventory, then ser...

GHSA-H72H-PPCX-998P Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections network.listenaddr is set, which is the default. Summary The P2P codec's Codec::decode method calls src.reservebodylen + HEADERLEN after parsing a 24-byte protocol header,...

WordPress Zakra theme <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Zakra versions = 4.2.0...

MINI-HQ6C-994X-9RHG

Bulletin has no description...

CVE-2026-54402

creationtimestamp| type| source ---|---|--- 2026-07-02 18:19:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mponh36wia2z 2026-07-03 07:08:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppyewqvlf2d 2026-07-03 21:36:06+00:00| seen|...

EUVD-2026-41416

Craft CMS is a content management system CMS. Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function...

kernel: ipv4: account for fraggap on the paged allocation path

A flaw was found in the Linux kernel's handling of IPv4 network packets. An error in how the kernel accounts for fragmented data during memory allocation can lead to an undersized memory buffer. This memory handling issue could potentially be exploited by a remote attacker to cause a system crash...