295296 matches found
PT-2026-120466
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...
PT-2026-120481
The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: grafana (UTSA-2026-142362)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142362 advisory. Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link...
PT-2026-120768
Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.1 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description An unauthenticated client can control...
PT-2026-120469
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to...
PT-2026-120451
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...
PT-2026-120461
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators...
PT-2026-120918
This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacke...
Fedora 44 : gnome-shell-extension-gsconnect (2026-37da8aa1f8)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-37da8aa1f8 advisory. Voici les notes de la release, telles que publies par daniellandau le 2026-09-23 : --- Release GSConnect v73 What's Changed Security: fix authenticated path...
PT-2026-120789
Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description The origin server auth plugin allows ...
PT-2026-120485
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
PT-2026-120446
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site,...
PT-2026-120462
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin befo...
CLSA-2026-1792540680 TuxCare security update for @babel/plugin-syntax-decorators (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-decorators to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
CLSA-2026-1792540679 TuxCare security update for @babel/plugin-syntax-decorators (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-decorators to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
CLSA-2026-1792540678 TuxCare security update for @babel/plugin-syntax-decorators (2 CVEs)
TuxCare rebuilt @babel/plugin-syntax-decorators to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...
CLSA-2026-1792540677 TuxCare security update for @babel/plugin-syntax-decorators (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-decorators to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
CLSA-2026-1792540676 TuxCare security update for @babel/plugin-syntax-decorators (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-decorators to address 1 CVE. Fixed in 7.25.7-tuxcare.4...