EUVD-2026-86399

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Modification vulnerability discovered by Averon Averenkov Averon Averenkov in WordPress Plugin Blog2Social versions = 9.1.0...

CVE-2026-84302

The open-source discussion platform Discourse is vulnerable in versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 . The root cause is that reviewable visibility filtering fails to restrict Discourse AI reviewables associated with private messages. This allows moderators who are not part...

CVE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

CVE-2026-3253

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

EUVD-2026-85854

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-3253 MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

Security update for hplip

This update for hplip fixes the following issues: CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions bsc1281303. CVE-2026-91098: hi...

SUSE-SU-2026:4335-1 Security update for hplip

This update for hplip fixes the following issues: - CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions bsc1281303. - CVE-2026-91098...

buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability

A flaw was found in BuildKit. A custom client with valid permissions to access the BuildKit control API can produce an upload request that allows files to escape from the BuildKit-controlled state directory. This could lead to unauthorized modification or disclosure of sensitive data...

PT-2026-97736

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description Improper Access Control allows unauthorized access or modification of resources within the system. Recommendations Update to version 1.11.00.022 or later...

CVE-2026-95985: Inclusion of Functionality from Untrusted Control Sphere

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

PT-2026-98235

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description A SQL injection issue exists in the ServiceNow AI Platform. This flaw allows an unauthenticated user to execute arbitrary SQL statements against the underlying database,...

CVE-2026-3253: Missing Authorization

The MailerLite – Signup forms official plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with...

CVE-2026-6718

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-6718 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-6718 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-6718

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

EUVD-2026-85658

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

SUSE-SU-2026:23910-1 Security update for cjose

This update for cjose fixes the following issues: - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap-based buffer overflow bsc1279844. - CVE-2026-53939: zero-filled content-encryption key generation in AES-CBC-HMAC JWE encryption within cjose ca...