295318 matches found
CLSA-2026-1792411624 TuxCare security update for @babel/plugin-transform-typescript (1 CVE)
TuxCare rebuilt @babel/plugin-transform-typescript to address 1 CVE. Fixed in 7.29.0-tuxcare.1...
CLSA-2026-1792411626 TuxCare security update for @babel/plugin-transform-typescript (1 CVE)
TuxCare rebuilt @babel/plugin-transform-typescript to address 1 CVE. Fixed in 7.29.0-tuxcare.2...
CVE-2026-112188
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...
SUSE-SU-2026:24282-1 Security update for helm
This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....
CVE-2026-112192 MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and clionly flags that a module declares in its own configuration metadata. As a result: - A module that marks a setting such as an...
CVE-2026-112161
MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...
CVE-2026-112161
MobaXterm Personal Edition (Portable) 26.4 GA is vulnerable to a local code execution flaw due to a lack of integrity checks when extracting the CygUtils64.plugin file. An attacker with local write permissions can replace the bin/cygwin1.dll library within that plugin with a malicious version. Wh...
CVE-2026-112161 Lack of integrity checks in Mobatek’s MobaXterm
MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...
EUVD-2026-104122
MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...
CVE-2026-112161 Lack of integrity checks in Mobatek’s MobaXterm
MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...
CVE-2026-94294
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...
CVE-2026-94272
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...
CVE-2026-94231
The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices...
CVE-2026-74921
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that...
CVE-2026-74922
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...
CVE-2026-103311
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...
CLSA-2026-1792393388 TuxCare security update for @babel/plugin-transform-unicode-regex (2 CVEs)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CLSA-2026-1792393386 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.18.9-tuxcare.3...