RLSA-2026:36777 Important: unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack CVE-2026-40622 unbound: Unbound: Denial of...

CVE-2026-66011

A flaw was found in ImageMagick. This memory leak vulnerability occurs when invalid options are provided to the magick command-line interface CLI. An attacker can exploit this by repeatedly supplying malformed command-line arguments, leading to memory exhaustion and a denial of service DoS on the...

CVE-2026-15411 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-14328

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...

CVE-2026-14328

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...

CVE-2026-14328

The CVE-2026-14328 entry describes a Privilege Escalation in the Eazy Plugin Manager for WordPress (up to version 4.4.1). The root cause is insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which returns arbitrary WordPress options via get_option() after only a localized nonc...

EUVD-2026-49735

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...

CVE-2026-14328 Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...

CVE-2026-14328 Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...

CVE-2026-16797

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

CVE-2026-16797

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement for WordPress (plugin) is affected up to version 3.4.5 by an Insecure Direct Object Reference via the optionSection parameter. The flaw arises from missing validation on a user-controlled key, enabling authenticated attackers with con...

CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

CVE-2026-16797

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

PT-2026-65431

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wp ajax pos get option AJAX handler, which verifies only a nonce tha...

PT-2026-65447

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perfor...

PT-2026-65400

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

WordPress StoreGrowth plugin <= 2.1.0 - Missing Authorization to Unauthenticated Options Update vulnerability

Missing Authorization to Unauthenticated Options Update vulnerability discovered by Wordfence PRISM in WordPress Plugin StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions = 2.1.0...

K000162456: NLnet Labs Unbound vulnerability CVE-2026-41292 and CVE-2026-42944

Security Advisory Description CVE-2026-41292 NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage whil...

SUSE CVE-2026-66011

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...