PT-2026-104086

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option...

CVE-2025-13342

CVE-2025-13342 Frontend Admin by DynamiApps - ----/| |/ ----| \ ||/ / / / //// |// |/ ◈ Vulnerability Field| Detail ---|--- CVE ID| CVE-2025-13342 Score| 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence Affected| Frontend Admin by DynamiApps ≤ 3.28.20 Auth| None —...

Exploit_CVE-2026-3854

ExploitCVE-2026-3854 CVE-2026-3854 is a Remote Code Execution in GitHub.com and GitHub Enterprise Server The vulnerability could be exploited by injecting commands into the git push command as follows : git push -o '' origin master To review any exploitation of this vulnerability, we recommend th...

PYSEC-2026-4146 PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

Summary PyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a confi...

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

SummaryPyJWT.decode/decodecomplete mutates a caller-supplied options dict in place whenever verifysignature is falsy, adding verifyexp/verifynbf/verifyiat/verifyaud/verifyiss/verifysub/verifyjti keys directly onto that object. If application code reuses the same options dict across calls a config...

openbsd_ov1

OpenBSD TCP/IP overflow Tested with latest OpenBSD 7.2 Details: int ipdooptionsstruct mbuf m, struct ifnet ifp ... for ; cnt 0; cnt -= optlen, cp += optlen opt = cpIPOPTOPTVAL; if opt == IPOPTEOL break; if opt == IPOPTNOP optlen = 1; else if cnt cnt code = &cpIPOPTOLEN - uchar ip; goto bad; switc...

EUVD-2026-90883

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...

Magneto-PolyShell

Magento 2 RCE Exploit - Unauthenticated File Upload to RCE ⚠️ This tool is for educational and authorized security testing only. Unauthorized use against systems you do not own is illegal. This exploit targets a critical unauthenticated remote code execution RCE vulnerability in Magento 2 Adobe...

CVE-2021-25032

CVE-2021-25032 PublishPress Capabilities 2.2 - 2.3 - Unauthenticated Arbitrary Options Update to Blog Compromise Description The plugin does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to t...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

AlmaLinux 9.2 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1751461369)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751461369 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.4:CLSA-2026:1777456062)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777456062 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New...

PT-2026-103904

Name of the Vulnerable Software and Affected Versions AWS EFS CSI Driver aws-efs-csi-driver versions 3.1.0 through 3.4.2 Description Improper neutralization of argument delimiters in the volume handling component allows remote authenticated users with PersistentVolume creation permissions to inje...

AlmaLinux 9.2 [TuxCare] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (ALMALINUX9.2:CLSA-2026:1783076363)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783076363 advisory. - A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP...

Rocky Linux 10.2 [CIQ] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (crlsa-2026_26532)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626532 advisory. dracut: dracut: Root code execution via DHCP options command injection CVE-2026-6893 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9.6 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-dracut / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1780068958)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780068958 advisory. - NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt...

Rocky Linux 8 [CIQ] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (crlsa-2026_26534)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626534 advisory. dracut: dracut: Root code execution via DHCP options command injection CVE-2026-6893 Tenable has extracted the preceding description block directly from the CIQ...

CentOS Linux 7 [TuxCare] Security Update: unbound / unbound-devel / unbound-libs / unbound-python Multiple Vulnerabilities (CENTOS7:CLSA-2026:1779978016)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1779978016 advisory. - NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists o...

RHEL 6 : dracut (RHSA-2026:74499)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74499 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...