CVE-2026-55810 Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2...

CVE-2026-55809

The Flag attendance field module for Drupal (versions 0.0.0 to 1.2) is vulnerable to PHP object injection due to the improper control of modification of dynamically-determined object attributes. The module stores certain data as PHP-serialized strings ; if an attacker can write malicious data dir...

CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...

CVE-2026-55475

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the createdby value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in...

CVE-2026-55475

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the createdby value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in...

CVE-2026-55475 Snipe-IT: Import created_by can be overwritten

Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the createdby value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in...

cpython: python: Extraction filter bypass for linking outside extraction directory

A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall or TarFile.extract with the...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Form Entry Modification vulnerability discovered by Michael Iden Mickhat in WordPress Plugin NEX-Forms versions = 9.2.2...

WordPress WP Easy Pay – Payment and Donation form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Status Modification vulnerability discovered by PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...

WordPress AI Copilot – Content Generator plugin <= 1.4.12 - Missing Authorization to Unauthenticated Arbitrary Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Modification vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.12...

CVE-2026-59796

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks...

WordPress Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia plugin <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Status Modification vulnerability discovered by loris4py in WordPress Plugin Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia versions = 3.3.3...

WordPress Notification for Telegram plugin <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Cron Modification vulnerability discovered by Pattama Tangpoonponwiwat Kwan in WordPress Plugin Notification for Telegram versions = 3.5.1...

WordPress MyParcel plugin <= 4.25.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Order Shipment Data Disclosure and Modification vulnerability discovered by nudien udin, nudien in WordPress Plugin MyParcel versions = 4.25.1...

CVE-2026-59796

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks...

CVE-2026-59796

CVE-2026-59796 affects JetBrains TeamCity prior to 2026.1.2. The issue arises from improper permission checks that could allow pipeline modification. Documented impact is pipeline modification with high impact on confidentiality and integrity (per CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). N...

CVE-2026-59796

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks...

WordPress Points and Rewards for WooCommerce plugin <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Modification vulnerability discovered by Latz in WordPress Plugin Points and Rewards for WooCommerce versions = 2.10.1...

RLSA-2026:35841 Important: nodejs24 security, bug fix, and enhancement update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

nodejs24 security, bug fix, and enhancement update

An update is available for nodejs24. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a platform built on Chrome's JavaScript runtime for easily...