CVE-2026-89424: Improper Neutralization of Input During Web Page Generation

The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notitoken' parameter in all versions up to, and including, 1.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-94276: Improper Authentication

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

Rocky Linux 9.6 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-python-plugin / etc Multiple Vulnerabilities (ciqsa-2026_1451)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261451 advisory. This advisory aggregates security fixes for the sudo SRPM in CIQ LTS 9.6. It addresses 5 CVEs: CVE-2023-28486, CVE-2026-35535, CVE-2025-32462,...

AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1787333229)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787333229 advisory. - A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when ...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1781607668)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781607668 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

AlmaLinux 9.2 [TuxCare] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc (ALMALINUX9.2:CLSA-2025:1744927038)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744927038 advisory. - Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute...

CentOS Linux 8 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS-STREAM8:CLSA-2026:1781551234)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1781551234 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_8259)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20268259 advisory. vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin CVE-2026-28417 vim: Vim: Denial of service and information disclosure via...

Rocky Linux 10.2 [CIQ] Security Update: mysql8.4 / mysql8.4-common / mysql8.4-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_20693)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620693 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1751142388)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751142388 advisory. - Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could...

CentOS Linux 7 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS7:CLSA-2026:1782139332)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782139332 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

Rocky Linux 8 [CIQ] Security Update: mecab / mecab-debuginfo / mecab-debugsource / mecab-devel / etc Multiple Vulnerabilities (crlsa-2026_26180)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202626180 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2026 CVE-2026-22004 mysql: Information Schema unspecified vulnerability CPU Apr 2026 CVE-2026-22001 mysql:...

Rocky Linux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1787333229)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787333229 advisory. - A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs whe...

Rocky Linux 8 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2024_1514)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20241514 advisory. libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution CVE-2023-6185 libreoffice: Insufficient macro permission validation...

PT-2026-103744

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

PT-2026-103702

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

PT-2026-103710

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...

PT-2026-103831

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.17.0 through 3.18.0 Description An improper verification of cryptographic signatures occurs within the saml-auth plugin under default configuration. This allows an unauthenticated attacker to impersonate any user on...

Rocky Linux 9 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2024_3835)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243835 advisory. libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution CVE-2023-6185 libreoffice: Insufficient macro permission validation...

PT-2026-103705

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...