CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

EUVD-2026-50121

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

CVE-2026-14300

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2026:3338-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3338-1 advisory. - CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution...

PT-2026-65697

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...

MiracleLinux 9 : postgresql:15 (AXSA:2026-1374:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1374:01 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libp...

CVE-2026-18107

CRIU vulnerability CVE-2026-18107 involves how CRIU handles restartable sequences (rseq) during checkpoint/restore. A container-embedded process can register an rseq critical section that hijacks CRIU’s parasite code injection, enabling spoofed credentials saved in the checkpoint image. On restor...

SUSE-SU-2026:3396-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - CVE-2024-4367: missing type check when handling fonts in PDF.js can allow arbitrary JavaScript execution bsc1271638. - CVE-2026-39872: maliciously crafted web content can lead to an unexpected process crash bsc1271638. - CVE-2026-43663:...

CVE-2026-66745

Artica Proxy before 4.50.000000 Service Pack 7 fixed in hotfix 20260724-02 contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controll...

CVE-2026-66745 Artica Proxy 4.50 Session Fixation via fw.login.php

Artica Proxy before 4.50.000000 Service Pack 7 fixed in hotfix 20260724-02 contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controll...

CVE-2026-66745 Artica Proxy 4.50 Session Fixation via fw.login.php

Artica Proxy before 4.50.000000 Service Pack 7 fixed in hotfix 20260724-02 contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controll...

EUVD-2026-49955

Artica Proxy before 4.50.000000 Service Pack 7 fixed in hotfix 20260724-02 contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controll...

Exploit for CVE-2026-8206

CVE-2026-8206 Vulnerability: Unauthenticated Account Takeo...

MiracleLinux 9 : postgresql-13.23-3.el9_8 (AXSA:2026-1366:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1366:07 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libp...

CVE-2026-66824 Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...

CVE-2026-59239

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

EUVD-2026-49389

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239 Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

MiracleLinux 9 : postgresql:16 (AXSA:2026-1358:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1358:01 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libp...

CVE-2026-48021

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic patient consent decisions, medication data,...