CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103266 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

BIT-KIBANA-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

CVE-2025-43537

CVE-2025-43537 Crédito de Seguridad de Apple Investigador: Al Sadman Awal Oficialmente acreditado por Apple Product Security por la divulgación responsable de CVE-2025-43537. Resumen CVE-2025-43537 es una vulnerabilidad de seguridad identificada durante una investigación de seguridad independient...

CVE-2026-82824

Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-12241

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'savemetaboxes' function in all versions up to, and including, 2.51. This makes it possible for authenticat...

CVE-2026-82824 Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0...

EUVD-2026-90478

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'savemetaboxes' function in all versions up to, and including, 2.51. This makes it possible for authenticat...

CVE-2025-12030

CVE-2025-12030: Referencia Directa Insegura a Objetos en el Plugin ACF to REST API de WordPress Palabras clave: CVE-2025-12030, vulnerabilidad de ACF to REST API, IDOR, seguridad de WordPress, explotación autenticada, vulnerabilidad de plugin de WordPress, CWE-639, modificación de campos ACF,...

PT-2026-103670

Name of the Vulnerable Software and Affected Versions Advanced Woo Labels – Product Labels & Badges for WooCommerce versions prior to 2.52 Description An improperly secure capability check in the save meta boxes function allows authenticated attackers with Contributor-level access or higher to...

CVE-2026-103266: Incorrect Authorization

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

CVE-2026-66246: Execution with Unnecessary Privileges

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references IDOR, enabling privilege escalation and the unauthorized modification or deletion of sensitive application data...

CVE-2026-103288: Authorization Bypass Through User-Controlled Key

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

AlmaLinux 9.2 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1743011981)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1743011981 advisory. - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or...

AlmaLinux 9.6 [TuxCare] Security Update: podman / podman-docker / podman-plugins / podman-remote / etc (ALMALINUX9.6:CLSA-2026:1782987821)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782987821 advisory. - Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path...

Rocky Linux 9 [CIQ] Security Update: perl-YAML-LibYAML / perl-YAML-LibYAML-debuginfo / etc (crlsa-2025_9330)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259330 advisory. yaml-libyaml: LibYAML Perl File Modification Vulnerability CVE-2025-40908 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 9.6 [TuxCare] Security Update: cargo / clippy / rust / rust-analyzer / rust-debugger-common / etc (ALMALINUX9.6:CLSA-2026:1788535576)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788535576 advisory. - tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's...

Rocky Linux 9.6 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785331296)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785331296 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster ima...

Rocky Linux 8 [CIQ] Security Update: aardvark-dns / buildah / buildah-debuginfo / buildah-debugsource / etc Multiple Vulnerabilities (crlsa-2022_7822)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227822 advisory. podman: possible information disclosure and modification CVE-2022-2989 buildah: possible information disclosure and modification CVE-2022-2990 Tenable has...