PT-2026-68056

Name of the Vulnerable Software and Affected Versions Backup Migration plugin for WordPress versions prior to 2.1.5.2 Description OS Command Injection occurs due to insufficient sanitization of the file POST parameter within the restoreBackup AJAX handler. The handler uses esc attr, which is an...

PT-2026-78385

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description An authentication bypass exists in the SetupController when maintenance mode is enabled. This allows unauthenticated remote attackers to execute database migrations and create configuration backups...

`nostr-relay-pool` is unmaintained

The nostr-relay-pool crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

RUSTSEC-2026-0237 `nostr-relay-builder` is unmaintained

The nostr-relay-builder crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

RUSTSEC-2026-0243 `nostr-relay-pool` is unmaintained

The nostr-relay-pool crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

`nostr-relay-builder` is unmaintained

The nostr-relay-builder crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into nostr-sdk starting with version 0.45.0. Users should migrate to nostr-sdk...

WordPress Backup Migration plugin <= 1.2.8 - Sensitive Information Exposure vulnerability

Sensitive Information Exposure vulnerability discovered by Wadeek in WordPress Plugin Backup Migration versions = 1.2.8...

Fedora 43 : goaccess (2026-a488a993d1)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a488a993d1 advisory. Update to goaccess 1.11. Notable fixes: - Fixed a heap buffer overflow when parsing malformed Opera user agents - Fixed an infinite loop while writing log...

Virtuozzo Infrastructure 7.4 Hotfix 1 (7.4.0-75)

This update provides stability fixes. Vulnerability id: VSTOR-102068, VSTOR-102069, VSTOR-138302 Creating a VM in a server group could fail with "No valid host found" because a previously canceled or failed VM remained in the server group. Vulnerability id: VSTOR-120923 VPN could stop working whe...

Fedora 44 : goaccess (2026-b1c2d1af74)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b1c2d1af74 advisory. Update to goaccess 1.11. Notable fixes: - Fixed a heap buffer overflow when parsing malformed Opera user agents - Fixed an infinite loop while writing log...

CVE-2026-17555

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the exportdata parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values a...

CVE-2026-17555: Improper Neutralization of Special Elements used in an SQL Command

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the exportdata parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values a...

WordPress WPvivid — Backup, Migration & Staging plugin <= 0.9.131 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WPvivid Backup and Migration versions = 0.9.131...

WordPress Demi – One Click Demo Import, Backup & Site Migration plugin <= 0.0.7 - Unauthenticated Arbitrary Directory Deletion vulnerability

Unauthenticated Arbitrary Directory Deletion vulnerability discovered by Spy0x7 in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions = 0.0.7...

WordPress Demi plugin < 0.0.7 - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure vulnerability

WordPress Demi plugin 0.0.7 - One Click Demo Import, Backup & Site Migration 0.0.7 - Unauthenticated Sensitive Data Exposure vulnerability discovered by Pavan N in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions 0.0.7...

PT-2026-75900

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.3.0 Description When migrating an instance to another cluster member, user-supplied configuration overrides are applied without project restriction enforcement. This allows a restricted project user to manipulate...

SUSE CVE-2026-22874

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering...

SUSE CVE-2026-52805

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery SSRF vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror follows HTTP redirects. An authenticated...

CVE-2026-67433 Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...

CVE-2026-67433 Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...