CVE-2026-89296: Improper Neutralization of Special Elements used in an SQL Command

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

PT-2026-105199

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq jms topic exchange plugin's x-jms-topic exchange accepted a client-controlled rjms erlang selector binding expression whose LIKE evaluator expanded percent and underscore wildcar...

PT-2026-103702

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

CVE-2026-90972: Improper Access Control

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-81739: Improper Neutralization of Input During Web Page Generation

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated user...

PT-2026-103765

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

PT-2026-103719

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.9 Description An Insecure Direct Object Reference exists via the CourseMaterialTemplate::render material items callback exposed on the public...

PT-2026-103833

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 1.3.0 through 3.18.0 Description The batch-requests plugin contains a flaw where resources are allocated without limits or throttling. An unauthenticated caller can cause a gateway worker to experience Out of Memory OOM—...

PT-2026-105191

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl options/1 falls back to verify, verify none with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the brok...

PT-2026-105153

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG DEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentials obfuscation:decrypt called in...

PT-2026-103835

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.12.0 through 3.18.0 Description Improper Authentication occurs when using the openid-connect plugin with remote introspection against an authorization server that serves multiple issuers. In this scenario, a token that...

CentOS Linux 7 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS7:CLSA-2026:1782139332)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782139332 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

Rocky Linux 10.2 [CIQ] Security Update: mysql8.4 / mysql8.4-common / mysql8.4-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_56007)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202656007 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-47064...

Rocky Linux 8 [CIQ] Security Update: mecab / mecab-debuginfo / mecab-debugsource / mecab-devel / etc Multiple Vulnerabilities (crlsa-2026_25919)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625919 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001 mysql:...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1751889956)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751889956 advisory. - Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a...

CentOS Linux 8 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS-STREAM8:CLSA-2026:1781551234)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1781551234 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

Rocky Linux 9.6 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-python-plugin / etc Multiple Vulnerabilities (ciqsa-2026_1451)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261451 advisory. This advisory aggregates security fixes for the sudo SRPM in CIQ LTS 9.6. It addresses 5 CVEs: CVE-2023-28486, CVE-2026-35535, CVE-2025-32462,...

Rocky Linux 8 [CIQ] Security Update: mecab / mecab-debuginfo / mecab-debugsource / mecab-devel / etc Multiple Vulnerabilities (crlsa-2026_26180)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202626180 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001 mysql:...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1751142388)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751142388 advisory. - Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1781607668)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781607668 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...