CVE-2026-85133

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin (versions before 4.4.2 ) is vulnerable to a lack of capability and nonce checks on specific A/B testing actions. This security flaw allows any authenticated user, including those with low-level permissions like a subscriber , to overwrite the cookie banner...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability

Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability discovered by RIA Labs in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-82185 WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-82184 WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

EUVD-2026-74710

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

CVE-2026-82184

The WPLP Cookie Consent WordPress plugin (versions before 4.4.2 ) is vulnerable to an unauthenticated attack due to a lack of authorization and CSRF checks when storing visitor consent state. Because the vulnerable code executes on every front-end page load, an unauthenticated attacker can overwr...

CVE-2026-82184 WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

PT-2026-89180

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-82184: Missing Authorization

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

PT-2026-89171

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An issue exists in the channel branch of the chat completions handler where the system verifies if a user has write access to a channel and if a specific message belongs to that channel, but...

CVE-2026-88069: Improper Limitation of a Pathname to a Restricted Directory

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

PT-2026-88849

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

ALSA-2026:65998 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

Backblaze Personal Computer Backup bzreports Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...

RHEL 8 : gzip (RHSA-2026:65998)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65998 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files...

Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific fla...