Astra Linux – Vulnerability in libxml2

The parser.c file in libxml2 before version 2.9.5 does not prevent infinite recursion in parameter entities...

CVE-2026-69127

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

CLSA-2026-1776214337 TuxCare security update for drupal/core (11 CVEs)

TuxCare rebuilt drupal/core to address 11 CVEs. Fixed in 9.5.11-p1+tuxcare...

MINI-M6X2-953M-X536

Bulletin has no description...

CVE-2026-67191

Xlight FTP Server prior to 3.9.5 is affected by a pre-authentication heap buffer overflow in the SSH parser. A logic error in the recv loop termination (OR instead of AND) enables exploitation on any SSH or SFTP connection before authentication, allowing remote unauthenticated access with high im...

DEBIAN-CVE-2026-54620

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5...

CVE-2026-54619

sqlite3-ruby bindings (Ruby gem sqlite3) are affected in versions

Exploit for CVE-2026-63030

wp2shell: WordPress Batch RCE A technical breakdown of CVE-20...

CVE-2026-63030

CVE-2026-63030 is a critical WordPress Core flaw in the REST API batch endpoint that, when combined with CVE-2026-60137, enables unauthenticated SQL injection via the author__not_in path and can lead to Remote Code Execution. Affected releases include WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; fixed ...

2026-07 Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB5099535)

2026-07 Cumulative Update for Windows 10 Version 1607 for x64-based Systems KB5099535...

LoLLMS Path Traversal vulnerability

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitizepathfromendpoint and sanitizepath functions in lollmscore\lollms\security.py. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises...

RockyLinux 10 : rrdtool (RLSA-2026:33731)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:33731 advisory. rrdtool: Stack buffer overflow in rrdcached handlerequestcreate allows local privilege escalation via unbounded DS/RRA arguments CVE-2026-43958 Tenable has...

CVE-2026-12073

CVE-2026-12073 affects the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress (versions ≤ 5.9.9.5). The root cause is the plugin not validating a user_login on some registration forms and mishandling errors, enabling unauthenticated attackers to overwrite the email of the ad...

PT-2026-52768

Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 1.9.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 1.9.5...

vtk vtk-dicom vtkDICOMItem::FindDataElementOrInsert heap-based buffer overflow vulnerability

Summary A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom versions: 9.5.2. A specially crafted DICOM file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-48970

Unauthenticated Broken Authentication in Really Simple SSL = 9.5.10 versions...

CVE-2026-53694

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Nomachine allows Argument Injection.This issue affects Nomachine: before 9.5.7, before 8.23.2...

CVE-2026-10721

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7 f...

AlmaLinux 10 : kernel (ALSA-2026:19569)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:19569 advisory. kernel: net: afcan: do not leave a dangling sk pointer in cancreate CVE-2024-56603 kernel: net/sched: Make cakeenqueue return NETXMITCN when past...

CVE-2026-8433

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/backend/file rescan. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...