SUSE-SU-2026:4371-1 Security update for hplip

This update for hplip fixes the following issues: - CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions bsc1281303. - CVE-2026-91098...

Security update for hplip

This update for hplip fixes the following issues: CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions bsc1281303. CVE-2026-91098: hi...

SUSE-SU-2026:4364-1 Security update for hplip

This update for hplip fixes the following issues: - CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions bsc1281303. - CVE-2026-91098...

Security update for hplip

This update for hplip fixes the following issues: CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions bsc1281303. CVE-2026-91098: hi...

SUSE-SU-2026:4362-1 Security update for hplip

This update for hplip fixes the following issues: - CVE-2026-91097: high severity issue - multiple vulnerabilities enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions bsc1281303. - CVE-2026-91098...

Improper Cryptographic Verification

Bouncy Castle for Java is vulnerable to Improper Cryptographic Verification. The vulnerability is due to the content not being properly bound to the MAC, which allows an attacker to modify the authenticated content without the integrity check detecting the tampering...

BIT-MONGODB-2026-18712 Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-100872

Sylius versions before 2.1.16 and 2.2.9 are vulnerable to an order total manipulation flaw. The system fails to validate payment amounts during cart recalculation , allowing unauthenticated attackers to modify order totals after a gateway transaction has been initiated. Specifically, an attacker ...

EUVD-2026-87944

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...

CVE-2026-86839

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-86839

The Online Scheduling and Appointment Booking System (Bookly) WordPress plugin, in versions before 28.3 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that appointment and payment records requested through staff-role AJAX actions actually bel...

CVE-2026-86839 Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

WordPress Online Scheduling and Appointment Booking System plugin < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability

Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability discovered by Vũ Quang Huy in WordPress Plugin Bookly versions 28.3...

CVE-2026-86839 Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-86839: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

EUVD-2026-87793

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...

CVE-2026-72662

Kibana versions 8.x (8.0.0 to 8.19.21) and 9.x (9.4.0 to 9.4.5) are vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639). This flaw allows an authenticated user with Timeline feature privileges within a Kibana space to bypass Access Control Lists (ACLs) to enumerate, read, ...

CVE-2026-100614

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

CVE-2026-100629

A flaw was found in Capgo backend. This vulnerability allows an authenticated administrator to perform unauthorized role modifications and demote higher-privileged accounts. When updating role bindings, the application validates the rank of the newly assigned role against the caller's privileges,...