CVE-2026-109935 Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author...

CVE-2026-109935

The Otter Blocks WordPress plugin (versions before 3.2.8 ) contains a vulnerability where it fails to enforce block visibility conditions when a published post is rendered via the WordPress REST API . This allows unauthenticated users to read restricted block content intended only for specific ro...

PT-2026-121772

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 7.9.2 Description An issue exists where an HTML rewriting routine is not restricted to stylesheet content, causing the removal of a quote that terminates an attribute in the rendered page. Whe...

PT-2026-121774

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user Subscriber can...

Linux Distros Unpatched Vulnerability : CVE-2026-101750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server:...

Apple container security vulnerability

Versions of the Apple container prior to 1.5.0 contain a security vulnerability. This vulnerability allows attackers to write to the container’s file system and insert an exec credential plugin into /etc/kubernetes/admin.conf. When kubectl runs on the host, it executes this plugin as a macOS user...

Stape GTM Server Side Plugin information disclosure vulnerability

Versions 2.0.0 through 2.1.48 of the Stape GTM Server Side Plugin contain an information disclosure vulnerability. This vulnerability arises because WooCommerce’s purchase event tracking mechanism allows unauthenticated attackers to render JavaScript data layers containing full order details...

PT-2026-122222

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792757203)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792757203 advisory. - Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive...

Linux Distros Unpatched Vulnerability : CVE-2026-91484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Java plugin. Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit...

Linux Distros Unpatched Vulnerability : CVE-2026-101773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...

Linux Distros Unpatched Vulnerability : CVE-2026-101780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server:...

PT-2026-121773

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 7.9.2 Description An HTML optimization routine fails to limit its operations to stylesheet content, which can lead to the deletion of markup that closes an attribute in the rendered page. When...

Linux Distros Unpatched Vulnerability : CVE-2026-101776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...

CVE-2026-101780

A flaw was found in the MySQL Server X Plugin component. An authenticated remote attacker with low privileges and network access can exploit this vulnerability through network protocol requests. Successful exploitation allows the attacker to cause the database server to hang or repeatedly crash,...

CVE-2026-101776

A flaw was found in the MySQL Group Replication plugin. A remote attacker with high privileges and network access can exploit this vulnerability across multiple protocols. Successful exploitation allows the attacker to cause the service to hang or crash repeatedly, resulting in a complete Denial ...

CVE-2026-101750

A flaw was found in the MySQL Clone Plugin. An authenticated remote attacker with high privileges can exploit this vulnerability over network protocols to trigger an abnormal condition. A successful attack allows the attacker to cause the database server to hang or repeatedly crash, resulting in ...

CVE-2026-101773

A flaw was found in the MySQL Group Replication plugin. An unauthenticated attacker located on the adjacent network can exploit this vulnerability to compromise the database service. Successful exploitation primarily allows an attacker to cause a Denial of Service DoS by hanging or repeatedly...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient enforcement of root namespace restrictions in the catalog API. An attacker can modify plugin registrations, including removing existing registrations, creating invalid ones, or registering...

CVE-2026-115366

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...