Rocky Linux 10.2 [CIQ] Security Update: python3-unbound / python3-unbound-debuginfo / unbound / etc Multiple Vulnerabilities (crlsa-2026_36320)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202636320 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

Rocky Linux 9 [CIQ] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (crlsa-2026_26533)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626533 advisory. dracut: dracut: Root code execution via DHCP options command injection CVE-2026-6893 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1780068958)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780068958 advisory. - NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt...

GHSA-GVP8-978C-RX2Q PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

Modification of Assumed-Immutable Data (MAID)

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Modification of Assumed-Immutable Data MAID in the mergeoptions method in jwt/apijwt.py, which writes verifyexp, verifynbf, verifyiat, verifyaud, verifyiss, verifysub, and verifyjti directly...

DEBIAN-CVE-2026-103001

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options

A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security TLS certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently...

CVE-2026-103001 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

CVE-2026-103001

The PyJWT library (versions 2.11.0 through 2.13.0 ) contains a vulnerability where the PyJWT._merge_options() method modifies a caller-supplied mutable options mapping when verify_signature is set to false . If an application reuses this same mapping for subsequent decode() or decode_complete() c...

CVE-2026-103001 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

CVE-2026-102392

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102392 WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

EUVD-2026-90225

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

CVE-2026-102392

The Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin for WordPress is vulnerable to a PHP Object Injection vulnerability in versions

NPM: Axios: Prototype Pollution Gadget in axios toFormData Options

NPM: Axios: Prototype Pollution Gadget in axios toFormData Options vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.34.0...

undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options

A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security TLS certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently...

Exploit for CVE-2026-97347

CVE-2026-97347 — Stored XSS in Post Views Stats Counter WordP...

CentOS Linux 8.4 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2025:1749481543)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2025:1749481543 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.0-8.0.41...