Linux Distros Unpatched Vulnerability : CVE-2026-102265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueErro...

CVE-2026-96817: Missing Authorization

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

WordPress Smart Slider 3 plugin <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Smart Slider 3 versions = 3.5.1.38...

GHSA-GR2M-V5GQ-V685 Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Impact Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes. Apps are only affected i...

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Impact Windows opened from a sandboxed top-level document did not inherit that document's HTML sandbox restrictions, so content that was meant to run sandboxed could open a window with the app's full origin. GHSA-hq2x-r82h-9wj4 covers the same issue for sandboxed iframes. Apps are only affected i...

CVE-2026-90907

Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...

CVE-2026-90907

The Joomla! Core software versions 1.5.0-5.4.8 and 6.0.0-6.1.3 are vulnerable to unauthorized user account creation. The root cause is a failure in the profile.save controller , which does not verify the login state of a user. This allows unauthenticated attackers to create guest-level users on w...

EUVD-2026-89085

Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...

CVE-2026-10518

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2026-10518

GitLab EE is impacted by an incorrect authorization vulnerability affecting versions 17.9 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 . Due to improper authorization enforcement, an authenticated user with guest-level permissions could, under certain conditions, read private secur...

CVE-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

WordPress ConvertPlus plugin <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection vulnerability

Authenticated Subscriber+ PHP Object Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ConvertPlus versions = 3.6.3...

PT-2026-102688

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 1.5.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description The profile.save controller fails to verify the login state of a user. This allows the unauthorized creation of guest-level user accounts on websit...

CVE-2026-90913: Improper Access Control

Joomla! Core - 20260903 - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access level endpoints...

GitLab 17.9 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-10518)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated...

CVE-2026-10518: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2026-102265

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...

CVE-2026-102265 PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...

EUVD-2026-88549

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS.load in jwt/apijws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the...