PT-2026-103022

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

PT-2026-103357

🚨 CVE-2026-47498 NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor GSP plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges...

AlmaLinux 9.2 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787336081)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787336081 advisory. - A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV...

CVE-2026-47496: Out-of-bounds Write

NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager vGPU plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of privileges, data...

CVE-2026-96886: Exposure of Sensitive Information to an Unauthorized Actor

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course...

CVE-2026-55224: Improper Limitation of a Pathname to a Restricted Directory

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

PT-2026-103036

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.6:CLSA-2026:1788429305)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788429305 advisory. - A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate...

PT-2026-103355

🚨 CVE-2026-47496 NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager vGPU plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of...

PT-2026-103163

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

AlmaLinux 9.2 [TuxCare] Security Update: sudo / sudo-devel / sudo-python-plugin (ALMALINUX9.2:CLSA-2024:1709547826)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1709547826 advisory. - Sudo before 1.9.15 might allow row hammer attacks for authentication bypass or privilege escalation because application logic sometimes is...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (CENTOS6:CLSA-2026:1782153265)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1782153265 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in...

AlmaLinux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1787212689)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787212689 advisory. - In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL,...

Rocky Linux 9.6 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc (ALMALINUX9.6:CLSA-2026:1787212689)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787212689 advisory. - In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with QUERYDCL,...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aerismodsdk (>=0.1.1, <=0.1.5) +679 more potentially affected by CVE-2026-102269 via pyjwt (1.7.1)

pyjwt PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.1.1, =1.6.2, =0.1.1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.92.5, =2021.5.0b9 - alastria-identity...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aerismodsdk (>=0.1.1, <=0.1.5) +679 more potentially affected by CVE-2026-102267 via pyjwt (1.7.1)

pyjwt PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.1.1, =1.6.2, =0.1.1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.92.5, =2021.5.0b9 - alastria-identity...

MAL-2026-17293 Malicious code in @selfpentest/eslint-pentest-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f338876601180482b20a42fbd799b9d4e1b059bf7d733b5db448f7fc6d3455ff Package presents itself as an ESLint plugin but the exported plugin object is an empty shell. index.js unconditionally invokes a steal routine at top...

Malicious code in @selfpentest/eslint-pentest-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f338876601180482b20a42fbd799b9d4e1b059bf7d733b5db448f7fc6d3455ff Package presents itself as an ESLint plugin but the exported plugin object is an empty shell. index.js unconditionally invokes a steal routine at top...

CVE-2026-39117

An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...