CVE-2025-15674 Content Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2025-15674

Passster (WordPress plugin) before 4.3.7 allows low-privilege users with edit_posts capability to read globally password-protected content via the WordPress REST API when global protection is enabled. Any Contributor or higher can access protected pages/posts without the password. A fix is availa...

CVE-2026-18258

CVE-2026-18258 affects Scripta/eScriptorium up to version 26.04.1, impacting the Line, LineTranscription, VirtualCollection, tag and process API endpoints. The root cause is authorization bypass where a remote authenticated user can read, modify, and delete other users’ transcription content. Thi...

Important: gpsd-minimal security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The AlmaLinux support for this package is limited...

Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

GHSA-48HR-524C-V5W3 Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

CVE-2026-66298

CVE-2026-66298 concerns Livebook’s JS-view sandbox where untrusted, notebook-defined JavaScript can trigger session-wide keyboard shortcuts. The root cause is in the trusted iframe shell forwarding every keydown to the parent without checking Event.isTrusted, allowing events synthesized by the un...

EEF-CVE-2026-66298 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Summary Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a...

CVE-2026-66298 JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...

CVE-2026-71264

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

CVE-2026-71264 WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

CVE-2026-71264 WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

EUVD-2026-53349

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

CVE-2026-71264

CVE-2026-71264 affects WLED. The GET /json/cfg endpoint discloses the device’s general configuration (network, hardware, LED setup) to any unauthenticated client because it calls serveJson() without a settings-PIN check, unlike the /edit endpoint which enforces correctPIN. Additionally, the globa...

EUVD-2026-53347

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

CVE-2026-71262

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

MAL-2026-12488 Malicious code in tt-help-cli-ycl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6 The package's tt-help watchdog subcommand starts a long-running agent that POSTs heartbeats to a remote server default hardcoded to...

CVE-2026-44945

CVE-2026-44945 is a privilege escalation in Rancher’s impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated user with the default global role can obtain full admin access to the Rancher control plane and downstream clusters. Affected: Rancher 2.11.0–2.11.15, 2.12.0–2.12.11...

CVE-2026-44945 Cross-Cluster Impersonation Confused-Deputy Privilege Escalation

A privilege escalation vulnerability exists in Rancher's impersonation middleware pkg/auth/requests/impersonate.go. An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it...

CVE-2026-12000

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/, /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/. This is due to the plugin's...