PT-2026-125587

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

PT-2026-125588

TuxCare rebuilt @babel/plugin-transform-runtime to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

PT-2026-124509

TuxCare rebuilt @babel/plugin-proposal-numeric-separator to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-124505

TuxCare rebuilt @babel/plugin-proposal-numeric-separator to address 1 CVE. Fixed in 7.12.18-tuxcare.1...

PT-2026-124565

TuxCare rebuilt @babel/plugin-transform-object-assign to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-124562

TuxCare rebuilt @babel/plugin-transform-object-assign to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

PT-2026-124542

TuxCare rebuilt @babel/plugin-transform-flow-strip-types to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

PT-2026-115402

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

PT-2026-115467

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks on sites that use the WCFM Delivery add-on. This occurs because the plugin fails to sanitize and escape a parameter...

PT-2026-125577

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

RockyLinux 8 : grafana (RLSA-2026:83544)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:83544 advisory. grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION CVE-2026-15815 Tenable has extracted the preceding description block...

Amazon Linux 2023 : mariadb118, mariadb118-backup, mariadb118-client-utils (ALAS2023-2026-3236)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3236 advisory. A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the...

PT-2026-125581

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-124462

TuxCare rebuilt @babel/plugin-proposal-decorators to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-125583

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.11.5-tuxcare.3...

PT-2026-125586

TuxCare rebuilt @babel/plugin-transform-runtime to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-115497

Name of the Vulnerable Software and Affected Versions GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions prior to 2.8.193 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticat...

PT-2026-115472

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.31.9 Description The plugin fails to generate booking-API access tokens using a secure random source. Instead, tokens are derived from a hardcoded value and the specific second the tok...

PT-2026-124436

TuxCare rebuilt @babel/plugin-proposal-class-properties to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-115922

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data...