CVE-2026-23992 go-tuf improperly validates the configured threshold for delegations

go-tuf is a Go implementation of The Update Framework TUF. Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to...

CVE-2026-23951

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting ...

CVE-2026-23952

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL Magick Scripting Language parser when processing tags before images are loaded. This can lead to DoS attack due to...

EUVD-2026-4205

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting ...

CVE-2026-23951

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting ...

WordPress Plugin Depot security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-4100

Name of the Vulnerable Software and Affected Versions cjjparadoxmax Synergy Project Manager versions through 1.5 Description The Synergy Project Manager software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This...

PT-2026-4213

Cross-Site Request Forgery CSRF vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through = 1.3...

PT-2026-4119

Name of the Vulnerable Software and Affected Versions designthemes OneLife versions n/a through 3.9 Description A flaw exists in designthemes OneLife that allows for Object Injection due to deserialization of untrusted data. This issue impacts the application’s ability to securely handle incoming...

Azure Linux 3.0 Security Update: kernel (CVE-2024-49862)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49862 advisory. - In the Linux kernel, the following vulnerability has been resolved: powercap: intelrapl: Fix off by one in...

Azure Linux 3.0 Security Update: kernel (CVE-2024-41053)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-41053 advisory. - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix ufshcdabortone raci...

Azure Linux 3.0 Security Update: kernel (CVE-2025-37893)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37893 advisory. - In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error in...

PT-2026-3914

Name of the Vulnerable Software and Affected Versions Horilla version 1.4.0 Description Horilla, a Human Resource Management System HRMS, contains a flaw in its two-factor authentication implementation. Specifically, the OTP handling logic has a flawed equality check. When an OTP expires, the...

Ruijie AP180 Series Operating System Command Injection Vulnerability

The Ruijie AP180 Series is a series of panel-type wireless access points produced by the Chinese company Ruijie. Previous versions of the Ruijie AP180 Series, including those with model number 11.94B1P8, had a vulnerability related to operating system command injection. This vulnerability stems...

Azure Linux 3.0 Security Update: kernel (CVE-2024-46852)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46852 advisory. - In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA he...

Azure Linux 3.0 Security Update: fltk / teckit (CVE-2015-2158)

The version of fltk / teckit installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2015-2158 advisory. - Off-by-one error in the pngcrushmeasureidat function in pngcrush.c in pngcrush before 1.7.84 allows...

CVE-2025-66428

An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation...

WordPress plugin Holmes security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-4019

Name of the Vulnerable Software and Affected Versions Angel Costa WP SEO Search versions through 1.1 Description The software contains a Cross-Site Request Forgery CSRF flaw. This allows attackers to potentially perform actions on behalf of authenticated users without their knowledge...

PT-2026-3912

Horilla is a free and open source Human Resource Management System HRMS. Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing...