CVE-2026-113501

The LiteSpeed Cache WordPress plugin (versions before 7.9.2 ) is vulnerable to a privilege escalation issue due to a missing capability check on its admin-notice dismissal handler . Additionally, the nonce used for dismissal is not bound to the specific notice being dismissed. This allows a low-p...

CVE-2026-113501 LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user Subscriber can...

CVE-2026-113501 LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user Subscriber can...

EUVD-2026-108599

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment ...

EUVD-2026-108600

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose commen...

EUVD-2026-108596

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite, allowing a subsite administrator who is not trusted at the network level to approve arbitrary locations and...

CVE-2026-109935 Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author...

CVE-2026-109935

The Otter Blocks WordPress plugin (versions before 3.2.8 ) contains a vulnerability where it fails to enforce block visibility conditions when a published post is rendered via the WordPress REST API . This allows unauthenticated users to read restricted block content intended only for specific ro...

PT-2026-121774

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user Subscriber can...

Linux Distros Unpatched Vulnerability : CVE-2026-101750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server:...

Stape GTM Server Side Plugin information disclosure vulnerability

Versions 2.0.0 through 2.1.48 of the Stape GTM Server Side Plugin contain an information disclosure vulnerability. This vulnerability arises because WooCommerce’s purchase event tracking mechanism allows unauthenticated attackers to render JavaScript data layers containing full order details...

PT-2026-121772

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 7.9.2 Description An issue exists where an HTML rewriting routine is not restricted to stylesheet content, causing the removal of a quote that terminates an attribute in the rendered page. Whe...

PT-2026-122222

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...

Apple container security vulnerability

Versions of the Apple container prior to 1.5.0 contain a security vulnerability. This vulnerability allows attackers to write to the container’s file system and insert an exec credential plugin into /etc/kubernetes/admin.conf. When kubectl runs on the host, it executes this plugin as a macOS user...

Linux Distros Unpatched Vulnerability : CVE-2026-101780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-101773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...

Linux Distros Unpatched Vulnerability : CVE-2026-91484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Java plugin. Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit...

AlmaLinux 9.2 [TuxCare] Security Update: grafana Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792757203)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792757203 advisory. - Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive...

PT-2026-121773

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 7.9.2 Description An HTML optimization routine fails to limit its operations to stylesheet content, which can lead to the deletion of markup that closes an attribute in the rendered page. When...

Linux Distros Unpatched Vulnerability : CVE-2026-101776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...