CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

rev-dep v2.19.1

Rev-dep Capabilities • Installation • Documentation • Exploratory Toolkit • CLI Reference Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI. About 📣 As codebases scale,...

[SECURITY] Fedora 44 Update: nginx-mod-vts-0.2.4-13.fc44

Nginx virtual host traffic status module...

[SECURITY] Fedora 44 Update: nginx-mod-naxsi-1.6-21.fc44

naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...

[SECURITY] Fedora 44 Update: nginx-mod-fancyindex-0.6.0-8.fc44

The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: Custom headers. Either local or stored remotely. Cust...

[SECURITY] Fedora 44 Update: nginx-mod-js-challenge-0^20230517.gitda6852d-11.fc44

Simple JavaScript proof-of-work based access for Nginx with virtually no over head...

[SECURITY] Fedora 44 Update: nginx-mod-brotli-1.0.0~rc-13.fc44

NGINX module for Brotli compression...

[SECURITY] Fedora 44 Update: nginx-mod-headers-more-0.40-3.fc44

This module allows adding, setting, or clearing specified input/output header s. This is an enhanced version of the standard headers module because it provides more utilities like resetting or clearing "builtin headers" like Content-Type, Content-Length, and Server...

PT-2026-64136

The MCP SSE server started via ToolsMCPServer.run sse / launch tools mcp servertransport="sse" binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcp security.py provides exactly the needed controls...

PT-2026-64193

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.186 Description An out-of-bounds write occurs in the Codecs component, which could allow a remote attacker to perform a sandbox escape by using a specially crafted HTML page. A sandbox escape is a...

PT-2026-63614

The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens...

kernel security update

6.12.0-211.38.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

io_uring Heap Buffer Overflow DoS

The vulnerability of the iowqcreate function in the iouring module of the Linux kernel’s asynchronous input/output interface relates to improper memory release memory leak. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the am33xxpmprobe function in the drivers/soc/ti/pm33xx.c file of the Linux operating system’s kernel module is related to errors during link generation. Exploiting this vulnerability can allow an attacker to cause a system failure...

Linux kernel block-level support Heap Buffer Overflow DoS

The vulnerability of the calclcoefs function in the block/blk-iocost.c module of the Linux kernel’s block-level support mechanism is related to insufficient checking of input data when dividing by zero. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the generichwtstampioctllower function in the net/core/devioctl.c module, which supports network functions in the Linux kernel, is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Glances Cassandra Export Code Execution

The vulnerability of the Cassandra export module in the Glances monitoring tool’s application programming interface is related to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-60fc198d3b)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-60fc198d3b advisory. nginx-mod-fancyindex: - Rebuild for 1.30.4 nginx-mod-modsecurity: - Rebuild for 1.30.4 nginx-mod-naxsi: - Rebuild for 1.30.4 nginx-mod-headers-more:...

Linux Kernel BPF Trampoline Heap Buffer Overflow DoS

The vulnerability of the bpftrampolineupdate function in the kernel/bpf/trampoline.c module, which is part of the Linux operating system’s BPF interpreter support, relates to the execution of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to trigger a...

Linux net/smc/af_smc Heap Buffer Overflow DoS

The vulnerability of the smccreate function in the net/smc/afsmc.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to cause a service failure...