PT-2026-103705

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

PT-2026-103673

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.7.1 Description An issue allows unauthenticated attackers to execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before it is processed by the do shortcode function. T...

PT-2026-103954

Name of the Vulnerable Software and Affected Versions Capacitor versions prior to 6.2.2 Capacitor versions prior to 7.6.9 Capacitor versions prior to 8.3.5 Capacitor versions prior to 8.4.3 Capacitor versions prior to 8.5.1 Description The Android and iOS WebView navigation guard validates the ho...

PT-2026-105157

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get chunk selector/1 calls binary to atom on the raw client-supplied property from post-auth subscribe and resolve offset spec frames, with no whitelist and no existing guard. An authenticat...

PT-2026-105170

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list to atom/1 to every colon-delimited token in an attacker-controlled auth mechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a...

PT-2026-105165

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The rabbitmq...

Linux Distros Unpatched Vulnerability : CVE-2026-47503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager vGPU plugin, where a guest VM user may cause an out-of-bounds write by...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790239010)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790239010 advisory. - A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2026:1788427757)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788427757 advisory. - A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate...

AlmaLinux 9.2 [TuxCare] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc (ALMALINUX9.2:CLSA-2025:1744927038)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744927038 advisory. - Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute...

Rocky Linux 10.2 [CIQ] Security Update: mysql8.4 / mysql8.4-common / mysql8.4-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_20693)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620693 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001...

AlmaLinux 9.2 [TuxCare] Security Update: sudo / sudo-devel / sudo-python-plugin (ALMALINUX9.2:CLSA-2025:1752746954)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752746954 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788279341)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788279341 advisory. - A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended...

PT-2026-103707

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request,...

PT-2026-105161

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is authorized/2 calls rabbit mgmt util:is authorized/2, which checks only the management tag, instead of is authorized vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the...

PT-2026-105180

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max frame size, so cowboy's default of infinity...

CVE-2026-101925: Improper Neutralization of Input During Web Page Generation

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname via /wp-admin/profile.php + bbpreplycontent via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This make...

PT-2026-103701

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

PT-2026-103831

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.17.0 through 3.18.0 Description An improper verification of cryptographic signatures occurs within the saml-auth plugin under default configuration. This allows an unauthenticated attacker to impersonate any user on...

CVE-2026-103067: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0...