CVE-2026-24421

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated but does not verify that the requester has...

BIT-NODE-MIN-2025-55131

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

Get paid to scroll TikTok? The data trade behind Freecash ads

Loyal readers and other privacy-conscious people will be familiar with the expression, “If it’s too good to be true, it’s probably false.” Getting paid handsomely to scroll social media definitely falls into that category. It sounds like an easy side hustle, which usually means there’s a catch. I...

PT-2026-4789

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 Description The device ships with a predefined default password for a built-in authentication account. This account does not require a password change during initial...

Debian dla-4456 : openjdk-17-dbg - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4456 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4456-1 [email protected]...

Oracle HTTP Server (January 2026 CPU)

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory. - Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: Weblogic Server Proxy...

Fedora: Security Advisory (FEDORA-2026-b4b553ec05)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle HTTP Server (January 2026 CPU)

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory. - Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware component: Weblogic Server Proxy...

openSUSE 16 Security Update : chromium (openSUSE-SU-2026:20103-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20103-1 advisory. Changes in chromium: - Chromium 144.0.7559.96 boo1257011 CVE-2026-1220: Race in V8 - update INSTALL.sh to handle the addded tags in the desktop file...

MINI-4VHV-85JC-4RHC

Bulletin has no description...

WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Prowess versions = 2.3...

[SECURITY] [DSA 6110-1] openjdk-17 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6110-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 25, 2026 https://www.debian.org/security/faq -...

Security update for chromium (moderate)

openSUSE security update: security update for chromium ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20103-1 Rating: moderate References: bsc1256938 bsc1257011 Cross-References: CVE-2026-1220 Affected Products: openSUSE Leap 16.0...

January Linux Patch Wednesday

JanuaryLinux Patch Wednesday. In January, Linux vendors started fixing 918 vulnerabilities, one and a half times more than in December. Of these, 616 are in the Linux Kernel. Three show signs of exploitation in the wild: 🔻 AuthBypass - GNU Inetutils telnetd CVE-2026-24061 🔻 RCE - Safari...

CVE-2025-15516 All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update

The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxcallbackstoreusermeta function in versions 4.1.0 to 4.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

WordPress All-in-One Video Gallery plugin 4.1.0-4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited User Meta Update vulnerability discovered by kr0d in WordPress Plugin All-in-One Video Gallery versions 4.1.0-4.6.4...

OPENSUSE-SU-2026:20103-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 144.0.7559.96 boo1257011 CVE-2026-1220: Race in V8 - update INSTALL.sh to handle the addded tags in the desktop file boo1256938...

WordPress plugin All-in-One Video Gallery has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

A PUF-Based Security Framework for Fault and Intrusion Detection

Industrial Control Systems ICS rely on sensor feedback to keep safety-critical processes within operational limits. This research presents a hardware-root-of-trust that embeds a Physically Unclonable Function PUF at the measurement layer to authenticate sensor readings. The architecture combines...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: curl (UTSA-2026-004937)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004937 advisory. curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl...