CVE-2026-12973 PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

CVE-2026-12973

The CVE describes a vulnerability in the PayPlus Payment Gateway WordPress plugin prior to 8.2.2 where an unauthenticated user-accessible AJAX action does not perform authorization or order-ownership validation. This allows disclosure of the secret order key for arbitrary WooCommerce orders and, ...

Grafana Snapshot - Authentication Bypass

Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by...

Linux Distros Unpatched Vulnerability : CVE-2026-63999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ethtool: rss: fix indirtable and hkey leak on getrxfh failure rssprepareget allocates the indirection table and hash key buffer via rssgetdataalloc, then calls...

PT-2026-61552

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description A server-side request forgery SSRF issue exists in the JWKS fetcher. The system validates the URL hostname string against allow-lists but fails to verify the resolved IP addresses. An attacker with...

PT-2026-61577

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description When a JWT access method is configured using the ALGORITHM ES512 parameter within the DEFINE ACCESS statement, the system silently substitutes the ES384 algorithm. This occurs because the underlyin...

PT-2026-61732

Name of the Vulnerable Software and Affected Versions ClearanceKit versions prior to 5.0.10 Description ClearanceKit enforces per-process access policies by intercepting file-system access events on macOS. The software uses an ECDSA private key stored in the macOS System Keychain to sign the...

kernel security update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

srt -- Multiple vulnerabilities

The SRT project reports: CVE-2026-55869: Heap-Based Buffer Overflow in KMREQ Handling. A remote attacker may be able to trigger a heap-based buffer overflow during key material request processing, leading to a denial of service or potentially arbitrary code execution. CVE-2026-55868: Encryption...

Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

Cisco ASA IKEv1/IKEv2 Buffer Overflow (CVE-2016-1287)

A vulnerability in the Internet Key Exchange IKE version 1 v1 and IKE version 2 v2 code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code...

Linux Distros Unpatched Vulnerability : CVE-2026-64015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the...

Linux Distros Unpatched Vulnerability : CVE-2026-53389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/tcp-ao: fix use-after-free of key in delasync path In tcpaodeletekey, the delasync path skips the currentkey and rnextkey validity checks present in the...

Cisco ASA/FTD Observable Discrepancy (CVE-2022-20866)

A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to retrieve an RSA private key. This vulnerability is due to a logic error when the RSA key...

Important: amazon-ssm-agent

Issue Overview: An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state a...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-1952)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1952 advisory. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected...

SUSE CVE-2026-53389

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in delasync path In tcpaodeletekey, the delasync path skips the currentkey and rnextkey validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN...

SUSE CVE-2026-63823

In the Linux kernel, the following vulnerability has been resolved: keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy...

CVE-2026-64141

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compareguidkey sessionfdcheck walks the per-inode moplist during durable-handle session teardown and sets op-conn = NULL for every opinfo whose conn matched the closing session's connection...

CVE-2026-64015

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assocarrayfind in findkeytoupdate without holding the RCU read lock, while the assocarraygc code really is designed around...