CVE-2026-95623: Server-Side Request Forgery (SSRF)

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...

CVE-2026-12470: Improper Privilege Management

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

CVE-2026-9231: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

PT-2026-96856

Name of the Vulnerable Software and Affected Versions Tauri affected versions not specified Description The updater plugin contains a flaw where the 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When this parameter is set to true, the...

CVE-2026-95624: Improper Access Control

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

CVE-2026-7622: Missing Authorization

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

AlmaLinux 9 : sudo (ALSA-2026:69123)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:69123 advisory. sudo: Sudo: Policy bypass allows unauthorized program execution via execveat CVE-2026-82474 Tenable has extracted the preceding description block directly from th...

RHEL 9 : postgresql:15 (RHSA-2026:69698)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69698 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

CVE-2026-85279: Stack-based Buffer Overflow

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

CVE-2026-18439: Authorization Bypass Through User-Controlled Key

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

PT-2026-97058

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1 Description An authenticated user can cause a denial of service by...

PT-2026-96711

Name of the Vulnerable Software and Affected Versions Tauri HTTP plugin affected versions not specified Description The HTTP plugin validates requested URLs against the application's configured scope allowlist only during the initial request. If the remote server returns an HTTP 3xx redirect, the...

CVE-2026-61744

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

WordPress ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More plugin <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Deactivation vulnerability discovered by Que Thanh Tuan in WordPress Plugin ThumbPress versions = 6.2.1...

CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

EUVD-2026-84057

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-61744

InvenTree , an open-source inventory management system, is affected by an authorization bypass in its barcode-scan API (POST /api/barcode/) prior to 1.4.0 . The endpoint requires only authentication or a general read scope via IsAuthenticatedOrReadScope, and the built-in barcode plugin resolves o...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-73646 DESCRIPTION: PostCSS...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (6.3.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (6.3.0) +3 more potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=6.3.0, <=6.3.13)

org.graylog2:graylog2-server MAVEN version =6.3.0, =6.3.0, =6.3.0, =6.3.13 Source cves: CVE-2026-69190 Source advisory: MEND:CVE-2026-69190...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-69190 Source advisory: MEND:CVE-2026-69190...