CVE-2026-103264: Improper Authentication

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS...

CentOS Linux 7.9 [CIQ] Security Update: squid / squid-debuginfo / squid-migration-script / squid-sysvinit Multiple Vulnerabilities (ciqsa-2026_0740)

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260740 advisory. This advisory aggregates security fixes for the squid SRPM in CIQ CentOS Bridge 7.9. It addresses 7 CVEs: CVE-2021-28651, CVE-2021-31807, CVE-2021-28652...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc (crlsa-2026_3464)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20263464 advisory. kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration CVE-2026-23097 Tenable has extracted the preceding description block directly...

CVE-2026-97197

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

CVE-2026-97197 WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

CVE-2026-97197 WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

EUVD-2026-89898

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

CVE-2026-97197

The WordPress Backup & Migration plugin versions

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin (versions before 8.8.0 ) contains a vulnerability where a WebP-derivative file migration routine is not properly confined to the site's specific uploads directory. This flaw allows an attacker with Administrator-level access to rename or delete WebP-deriv...

CVE-2026-91072 EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-91072 EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

PT-2026-103040

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

PT-2026-103230

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

CVE-2026-97197: Missing Authorization

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

Important: Red Hat Security Advisory: Migration Toolkit for Applications

A new version of Migration Toolkit for Applications MTA is now available. Migration Toolkit for Applications MTA accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. This solution provides insight throughout the adoption process, at both...

Linux Distros Unpatched Vulnerability : CVE-2026-87799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an...

Amazon Linux 2 : ipa (ALAS-2026-3950)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3950 advisory. A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to...

CVE-2026-93284

A flaw was found in the Linux kernel's DRM Direct Rendering Manager pagemap subsystem. During page migration error handling, the kernel clears the page tracking array before finishing Direct Memory Access DMA unmapping operations. A local user could exploit this flaw by triggering migration...

CVE-2026-87799

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write...