CVE-2026-16603 Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API...

CVE-2026-16603

The Passster WordPress plugin is affected by CVE-2026-16603: versions prior to 4.3.6 do not enforce category-based content protection on the WordPress REST API, allowing unauthenticated users to read full content, title, and excerpt of category-locked posts via the core REST API. This is an unaut...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 Failure Record: MT6985 Adaptation Attempt...

CVE-2026-43766

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2026-43753

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information...

EUVD-2026-49542

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2026-43766

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2026-43753

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information...

EUVD-2026-49514

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2026-43753

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2026-43753

The CVE-2026-43753 issue is an out-of-bounds read fixed by Apple in iOS 26.6/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The root cause is improved bounds checking; exploitation would require physical access to a locked device and could reveal sensitive user data...

CVE-2026-64745

CVE-2026-64745 Affected software: macOS Sequoia (15.7.8) and macOS Tahoe (26.6) as the fixed releases. What’s impacted: A security issue fixed by restricting lock-screen access; a person with physical access to a locked device could potentially access contacts and photos. The available sources co...

GHSA-CR7P-CR3Q-H5CM Budibase: Account Enumeration via Login Lockout Response Differential

Summary The login lockout mechanism in Budibase creates an observable response discrepancy that allows unauthenticated attackers to enumerate valid email addresses. When an existing user's account is locked after 5 failed login attempts, the server returns a distinct 403 response with...

CVE-2026-47743

The CVE-2026-47743 issue affects Shopper’s admin Livewire components prior to v2.8.0. The root causes are: (1) IDOR-like vulnerability where public Eloquent identifiers could be rewritten in the wire payload due to missing #[Locked], enabling targeting of arbitrary records; (2) leakage of plainte...

CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...

EUVD-2026-47781

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

CVE-2026-59139

Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqreprecvlocked. The attach-time validator reqrepvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents...

CVE-2026-59143

CVE-2026-59143 affects Data::RoaringBitmap::Shared before 0.02 for Perl. An out-of-bounds read arises in rb_contains_locked due to an unvalidated container offset and cardinality: the attach-time validator checks header and region layout against file size but does not validate bucket contents, an...

CVE-2026-59139 Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked

Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqreprecvlocked. The attach-time validator reqrepvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents...

SUSE CVE-2026-63977

In the Linux kernel, the following vulnerability has been resolved: dpll: zl3073x: use dplldevicechangentf and remove changework The changework was introduced to send device change notifications from DPLL device callbacks without deadlocking on dplllock, since the callbacks are already invoked...