CVE-2026-103065: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1...

Linux Distros Unpatched Vulnerability : CVE-2026-85087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0...

CVE-2026-97343: Improper Authentication

The Burst Statistics – Simple WordPress Analytics Google Analytics Alternative plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the maybeloadshareddashboard handler issuing a genuine WordPress...

Linux Distros Unpatched Vulnerability : CVE-2026-90440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D...

Linux Distros Unpatched Vulnerability : CVE-2026-94645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This...

PT-2026-104582

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An improper authorization issue exists where delegated administrators can destroy sessions outside their assigned realms. This occurs because realm checks are performed using the requester's realm...

CVE-2026-91078: Improper Authentication

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-103514: Improper Authentication

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

CVE-2026-105119: Improper Authorization

OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose responsetype is exactly code, so codes issued through OpenID Connect hybrid flows code token, code idtoken, code token idtoken carry no bound challenge. An attacker who intercepts such a code ca...

Linux Distros Unpatched Vulnerability : CVE-2026-96294

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0...

Linux Distros Unpatched Vulnerability : CVE-2026-96277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.25.0...

Linux Distros Unpatched Vulnerability : CVE-2026-94651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - improper handling of exceptional conditions, Missing release of resource after effective lifetime vulnerability in Apache Thrift java bindings. This issue affec...

Linux Distros Unpatched Vulnerability : CVE-2026-94636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in...

PT-2026-104550

Name of the Vulnerable Software and Affected Versions Burst Statistics – Simple WordPress Analytics Google Analytics Alternative versions prior to 3.7.2 Description Improper authentication allows for account persistence. The maybe load shared dashboard handler issues a genuine WordPress session...

Linux Distros Unpatched Vulnerability : CVE-2026-94646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution'...

CVE-2026-71889: Improper Certificate Validation

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

Security Bulletin: Multiple Vulnerabilities in Hyper-Converged Database 1.2

Summary Multiple vulnerabilities were addressed in Hyper-Converged Database version 1.2.7 Vulnerability Details CVEID:CVE-2026-42583 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of...

nate158g-m-w-n-l-p-d-a-o-e

nate158g-m-w-n-l-p-d-a-o-e This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-frameworkclass MetasploitModule 'Wordpress Popular Posts Authenticated RCE', 'Description' = %q This exploit requires Metasploit to have a FQDN and the...

WordPress Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin <= 3.7.1 - Improper Authentication to Account Persistence vulnerability

Improper Authentication to Account Persistence vulnerability discovered by crow in WordPress Plugin Burst Statistics versions = 3.7.1...

Security Bulletin: Vulnerability in golang.org/x/mod bundled with IBM Fusion and IBM Fusion HCI

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the golang.org/x/mod library, which is affected by multiple vulnerabilities, including Improper verification of cryptographic signatures and integrity verification bypass. CVE-2026-56864, CVE-2026-56865. Vulnerability...