CVE-2026-86781

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

CVE-2026-86781 SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

CVE-2026-86781

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin, in versions before 4.7.40 , is vulnerable to unauthorized data disclosure. The root cause is a lack of capability or nonce checks on a certificate-file download routine that executes early in the WordPress admin request l...

CVE-2026-86781 SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

EUVD-2026-75970

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

CVE-2026-15462

CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...

Eris v0.55.1

Eris Eris is a desktop PGP workstation written in Go with Fyne. It stores keys in an encrypted vault and gives you a clean UI for signing, encryption, decryption, and verification. Features...

EUVD-2026-75777

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation...

PT-2026-90479

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the trusted key subsystem where the trusted tpm exit function releases the TPM chip reference and frees the digest array before unregistering the trusted key type. Thi...

PT-2026-96431

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted tpm exit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key type lookup holds key types sem for reading until the key operation...

Fluxion 6.32

Fluxion is a security auditing and social-engineering research tool. It is a remake of linset by vk496 with hopefully fewer bugs and more functionality. The script attempts to retrieve the WPA/WPA2 key from a target access point by means of a social engineering phishing attack. It's compatible wi...

RHEL 9 : openssh (RHSA-2026:66410)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66410 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary...

CVE-2026-62113: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

Malicious code in logs_update (crates.io)

logs-update is a malicious crate published to crates.io on 2026-09-10 with zero downloads. It pretends to be a terminal progress-bar library, but renders nothing to a terminal. The whole crate steals files and sets up remote access. The crate has no build script, so it does not run during cargo...

PT-2026-96068

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

CVE-2026-86781: Improper Authentication

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

PT-2026-89787

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

PT-2026-90323

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ecryptfs component where the parse tag 3 packet function fails to properly bound the encrypted key size variable against the ECRYPTFS MAX KEY BYTES limit. When...

PT-2026-90091

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the dm-pcache component where two fields decoded from the cache device are not properly bounded. The key num field, which drives cache kset crc and...