Exploit for CVE-2026-93659

CVE-2026-93659: Stored XSS in Concrete CMS Community Store Lea...

CVE-2026-85731 vulnerabilities

Vulnerabilities for packages: opentofu, manifest-tool, k8sgpt, k9s, flux-helm-controller, kargo, rancher-helm, kyverno-notation-aws, tigera-operator, xeol, cluster-api-helm-controller, gitness, helm-set-status, helm-push, kube-arangodb, maru, helm-mapkubeapis, cert-manager-cmctl...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: opentofu, manifest-tool, k8sgpt, k9s, flux-helm-controller, kargo, rancher-helm, kyverno-notation-aws, tigera-operator, xeol, cluster-api-helm-controller, gitness, helm-set-status, helm-push, kube-arangodb, maru, helm-mapkubeapis, cert-manager-cmctl...

CVE-2026-1242

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-1242 BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

EUVD-2026-83541

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-1242 BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-1242

The BlockSpare plugin for WordPress (Gutenberg Site Builder Blocks & Starter Sites) is vulnerable to authorization bypass in all versions up to and including 4.2.6 . The root cause is a logic error in the permission callback where an AND (&&) operator was used instead of an OR (||) operator, allo...

GHSA-W34Q-CM8F-9C5X vulnerabilities

Vulnerabilities for packages: caddy, kots, envoy-ai-gateway-fips, commercial-grafana, loki, grafana-pyroscope-fips, amazon-cloudwatch-agent-fips, harbor-registry-fips, grafana, dynatrace-operator, frankenphp-8.5, tempo-fips, grafana-mimir, caddy-fips, zot, dynatrace-operator-fips, grafana-fips,...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: caddy, kots, envoy-ai-gateway-fips, commercial-grafana, loki, grafana-pyroscope-fips, amazon-cloudwatch-agent-fips, harbor-registry-fips, grafana, dynatrace-operator, frankenphp-8.5, tempo-fips, grafana-mimir, caddy-fips, zot, dynatrace-operator-fips, grafana-fips,...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock — OPPO Find X5 Pro PFEM10 English · 中文READ...

GHSA-H7VF-4X9W-H99V vulnerabilities

Vulnerabilities for packages: opentofu, manifest-tool, k8sgpt, k9s, flux-helm-controller, kargo, rancher-helm, kyverno-notation-aws, tigera-operator, xeol, cluster-api-helm-controller, gitness, helm-set-status, helm-push, kube-arangodb, maru, helm-mapkubeapis, cert-manager-cmctl...

CVE-2026-85732 vulnerabilities

Vulnerabilities for packages: opentofu, manifest-tool, k8sgpt, k9s, flux-helm-controller, kargo, rancher-helm, kyverno-notation-aws, tigera-operator, xeol, cluster-api-helm-controller, gitness, helm-set-status, helm-push, kube-arangodb, maru, helm-mapkubeapis, cert-manager-cmctl...

GHSA-W34Q-CM8F-9C5X vulnerabilities

Vulnerabilities for packages: opentofu, loki, grafana-pyroscope, grafana-mimir, datadog-agent, zot, amazon-cloudwatch-agent, falcosidekick, aws-otel-collector, grafana, tempo, mcp-grafana, fluent-bit-plugin-loki, traefik, caddy, pulumi-kubernetes-operator, grafana-alloy, distribution,...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: opentofu, loki, grafana-pyroscope, grafana-mimir, datadog-agent, zot, amazon-cloudwatch-agent, falcosidekick, aws-otel-collector, grafana, tempo, mcp-grafana, fluent-bit-plugin-loki, traefik, caddy, pulumi-kubernetes-operator, grafana-alloy, distribution,...

GHSA-8WMF-6V46-5GFG vulnerabilities

Vulnerabilities for packages: falcoctl, opentofu, cloudflared, cluster-api-gcp-controller, timestamp-authority, cluster-api, azure-workload-identity-webhook, cloud-sql-proxy, etcd, istio, cluster-api-helm-controller, grafana-pyroscope, azure-service-operator, grafana-mimir, spicedb-operator,...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: falcoctl, opentofu, cloudflared, cluster-api-gcp-controller, timestamp-authority, cluster-api, azure-workload-identity-webhook, cloud-sql-proxy, etcd, istio, cluster-api-helm-controller, grafana-pyroscope, azure-service-operator, grafana-mimir, spicedb-operator,...

SUSE CVE-2026-73546

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

SUSE CVE-2026-86863

pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.getuser read config.WEBSERVERREMOTEUSER from request.environ and, when that returned...

CLEANSTART-2026-OX83822 Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator

Security vulnerability affects the vault package. Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator...