CVE-2026-103256

The n8n automation tool (versions before 2.39.6 and 2.40.x before 2.40.1 ) is vulnerable to a credentials leak via a preAuthentication Hook. The flaw resides in the Wekan and Baserow username-and-password credential types, where the application fails to properly validate host fields. Attackers wi...

CVE-2026-19253

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

EUVD-2026-90508

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

CVE-2026-19253

The Cache Enabler WordPress plugin before version 1.8.17 is vulnerable to an unauthenticated arbitrary file and directory deletion vulnerability. The root cause is a failure to validate a URL before using it to build a filesystem path within the cache purge routine . Because the plugin does not c...

CVE-2026-54088-poc

CVE-2026-54088: Command Injection via Authentication Hook Shell Substitution Pre-Authentication RCE Description This repository contains a Proof of Concept PoC for CVE-2026-54088, a critical OS Command Injection vulnerability in File Browser versions = 2.63.5. The vulnerability exists in the Hook...

Rocky Linux 10.2 [CIQ] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (crlsa-2026_54576)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654576 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the precedi...

Rocky Linux 9 [CIQ] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (crlsa-2026_54571)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654571 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the preceding...

Rocky Linux 8 [CIQ] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (crlsa-2026_54575)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654575 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the preceding...

Rocky Linux 10.0 [CIQ] Security Update: kea / kea-debuginfo / kea-debugsource / kea-doc / kea-hooks / etc Multiple Vulnerabilities (crlsa-2025_9178)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259178 advisory. kea: Loading a malicious hook library can lead to local privilege escalation CVE-2025-32801 kea: Insecure handling of file paths allows multiple local...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc (ciqsa-2026_1094)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261094 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2024-21626. Tenable has extracted the preceding...

Rocky Linux 9.6 [TuxCare] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (ALMALINUX9.6:CLSA-2026:1787152228)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787152228 advisory. - A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0857)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260857 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 37 CVEs: CVE-2021-36221, CVE-2021-41190,...

CVE-2026-19253: External Control of File Name or Path

The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites whe...

Rocky Linux 8.8 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0800)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260800 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.8. It addresses 39 CVEs: CVE-2020-10756, CVE-2021-3592,...

Rocky Linux 8.6 [CIQ] Security Update: oci-seccomp-bpf-hook / oci-seccomp-bpf-hook-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0122)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260122 advisory. This advisory aggregates security fixes for the oci-seccomp-bpf-hook SRPM in CIQ LTS 8.6. It addresses 33 CVEs: CVE-2018-25091, CVE-2024-34155,...

RHEL 6 : dracut (RHSA-2026:74499)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74499 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...

EUVD-2026-70988

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers...

EUVD-2026-74843

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution...

agentic-ioc-scanner

agentic-ioc-scanner IOC scanner for agentic AI coding tools — detects Mini Shai-Hulud, Gemini CLI RCE, Cursor CVE-2026-26268, and DPRK PromptMink. A detection kit for compromise of agentic AI coding assistants Claude Code, Gemini CLI, Cursor and the dependencies they pull into your repos. Eleven...

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

Summary In INPLACE mode DOMPurify sanitizes the caller's live DOM subtree directly. To close a known hazard GHSA-55q2-fjhq-7xh7, the library neutralizes any node a hook detaches during sanitization by stripping its subtree's non-allow-listed attributes, but this neutralization is wired only into...