EulerOS Virtualization 2.11.1 : sed (EulerOS-SA-2026-3472)

According to the versions of the sed packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic...

WP < 7.1.1 - Contributor+ Arbitrary Post Modification

Description WordPress does not properly verify that a user is allowed to edit a post when handling a post creation request that names an existing post in some cases, which could allow users with a role as low as contributor to overwrite the title, content and author of any post, including those...

Linux Distros Unpatched Vulnerability : CVE-2026-92487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: exfat: fix validsize extension over a shared writable mapping When a shared writable mapping...

CVE-2026-89138: Missing Authorization

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-90978: Improper Access Control

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-87966: Authorization Bypass Through User-Controlled Key

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

EulerOS Virtualization 2.12.0 : gzip (EulerOS-SA-2026-3642)

According to the versions of the gzip package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global stat...

Linux Distros Unpatched Vulnerability : CVE-2026-90086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set...

Linux Distros Unpatched Vulnerability : CVE-2026-90339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: powerpc/syscall: Fix syscall skip handling for seccomp and ptrace After enabling GENERICENTR...

PT-2026-95255

Name of the Vulnerable Software and Affected Versions Filter Gallery versions prior to 1.1.5 Description The plugin fails to verify the nonce a unique token used to prevent cross-site request forgery on several AJAX handlers when the nonce field is omitted. Additionally, it lacks capability check...

PT-2026-95236

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description The plugin fails to perform per-object authorization checks for image-optimization actions. It relies on a coarse capability shared by lower-privileged users and does not verify...

WordPress Core <= 7.1 - Contributor+ Arbitrary Post Overwrite vulnerability

Contributor+ Arbitrary Post Overwrite vulnerability discovered by Anthropic in WordPress core versions = 7.1...

CVE-2026-62278: Improper Limitation of a Pathname to a Restricted Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

EulerOS Virtualization 2.12.1 : gzip (EulerOS-SA-2026-3588)

According to the versions of the gzip package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global stat...

EulerOS Virtualization 2.11.1 : systemd (EulerOS-SA-2026-3477)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

DEBIAN-CVE-2026-54692

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file...

CVE-2026-54692

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file...

CVE-2026-54692

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sailcodecloadframev8xbm in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file...