CVE-2026-9018

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the easyelhandleregister function. This is due to the wpajaxnopriveelregister AJAX handler iterating the attacker-controlled...

CVE-2026-46727

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler rbgetaddrinfo in ext/socket/raddrinfo.c allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that...

CVE-2026-46727

An issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handler rbgetaddrinfo in ext/socket/raddrinfo.c allows a remote attacker who can delay DNS responses near the user-specified timeout to crash a Ruby process that...

PT-2026-42729

Name of the Vulnerable Software and Affected Versions Easy Elements for Elementor – Addons & Website Templates versions prior to 1.4.6 Description An issue exists in the easyel handle register function where the wp ajax nopriv eel register AJAX handler processes the custom meta POST array. The...

CVE-2026-8432

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/backend/file star. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Dror...

CVE-2026-7887

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 suspended, banned, terminated employee can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score o...

CVE-2026-7887

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 suspended, banned, terminated employee can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score o...

CVE-2026-7887

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 suspended, banned, terminated employee can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score o...

EUVD-2026-31331

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that pass...

rgui-3.4.4-seh-bof-exploit

Exploração de Buffer Overflow SEH Overwrite no RGui 3.4.4...

GHSA-RQ6V-X3J8-7QGF Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the Triton inference handler deserializes model artifacts without performing integrity verification, allowing...

Improper Validation of Integrity Check Value

Overview sagemaker-serve is a SageMaker Serve package for model serving and deployment Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the Triton inference handler. An attacker can execute arbitrary code with the SageMaker execution role's IAM...

CVE-2026-42002: Signal Handler Race Condition

Concurrency and locking defects in GSS-TSIG...

PT-2026-42642

Summary Amazon SageMaker Python SDK is an open-source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where, under certain circumstances, the Triton inference handler deserializes model artifacts without performing integrity verification, allowing...

Linux Kernel Security Vulnerabilities

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the lack of validation for the portcount field in the t7xxport EnumMsghandler function. This...

PT-2026-44143

Name of the Vulnerable Software and Affected Versions Symfony version 7.4 affected versions not specified Description The Cas2Handler builds the service parameter using Request::getSchemeAndHttpHost, which reflects the HTTP Host header when the framework.trusted hosts setting is not configured...

CVE-2026-7887: Improper Validation of Specified Type of Input

For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status. A user with uIsActive=0 suspended, banned, terminated employee can still authenticate via OAuth and receive valid API tokens. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score o...

org.xwiki.commons:xwiki-commons-classloader-protocol-jar (>=4.2-milestone-2, <=12.4), org.xwiki.commons:xwiki-commons-extension-api (>=11.10.11, <=16.10.16) +58 more potentially affected by CVE-2025-55748 +1 more via org.xwiki.commons:xwiki-commons-classloader-api (>=4.2-milestone-2, <=16.10.16)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =4.2-milestone-2, =4.2-milestone-2, =11.10.11, =4.2-milestone-2, =11.10.11, =11.10.11, =11.10.11, =11.10.11, =11.10.11, =11.10.11, =11.10.11, =11.10.11, =11.10.11, =11.10.11, =11.10.13 and more Source cves: CVE-2025-55748https://vulner...

org.xwiki.commons:xwiki-commons-extension-api (>=17.5.0, <=17.10.2), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=17.5.0, <=17.10.2) +10 more potentially affected by CVE-2025-55748 +1 more via org.xwiki.commons:xwiki-commons-classloader-api (>=17.5.0, <=17.10.2)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.10.0-rc-1, =17.5.0, =17.10.2 Source cves: CVE-2025-55748, CVE-2026-23734 Source advisory: SNYK:JAVA-ORGXWIKICOMMONS-16786796...

SQL Injection

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to SQL Injection via the process that handles SQL queries. An attacker can execute arbitrary SQL commands by injecting specially...