PT-2026-91411

Name of the Vulnerable Software and Affected Versions Really Simple Security plugin for WordPress versions prior to 9.8.2 Description An authorization check is missing in the profile-page update handler, allowing authenticated low-privileged attackers to bypass enforced two-factor authentication...

PT-2026-91744

Name of the Vulnerable Software and Affected Versions Takahe versions prior to 0.11.1 Description The software fails to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote actors to inject javascript: links. When clicked, these malicious link...

CVE-2026-82519: Missing Authorization

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...

MiracleLinux 9 : perl-DBI-1.643-9.el9_8.5 (AXSA:2026-1822:04)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1822:04 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the precedi...

TencentOS Server 3: perl-DBI (TSSA-2026:1006)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1006 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-89482

creationtimestamp| type| source ---|---|--- 2026-09-13 13:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvfpcgh6522n 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-57161

creationtimestamp| type| source ---|---|--- 2026-09-12 12:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvd3urae622c...

CVE-2026-62103

creationtimestamp| type| source ---|---|--- 2026-09-11 18:40:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvb7owcdmg2n 2026-09-11 20:08:19+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvbemoaql32y...

Android malware creates a hidden copy of your banking app

Researchers at Group-IB found that the Android banking Trojan Gigabud can create a separate work profile on an infected phone and run a cloned banking app inside it. The attacker can then carry out fraudulent transactions in the new profile, potentially separating them from signs of malware...

RLSA-2026:66179 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: Incomplete fix for...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DBI is a database access Application Programming Interface API for the Perl...

PT-2026-89856

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filter var..., FILTER VALIDATE URL, which...

PT-2026-89857

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute...

RockyLinux 9 : perl-DBI (RLSA-2026:66179)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66179 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...

CVE-2026-75624

creationtimestamp| type| source ---|---|--- 2026-09-10 22:58:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ho27jusdb3her 2026-09-17 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvq5c6awq62b...

CVE-2026-78569

creationtimestamp| type| source ---|---|--- 2026-09-10 22:34:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jgfwtuuoi7to6 2026-09-17 18:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mvqangnf3m2w...

Security Bulletin: Updating IBM WebSphere Liberty Profile in Identity Insight for security update

Summary Identity Insight customers are advised to update IBM WebSphere Liberty Profile WLP to version 26.0.0.9 for security update in WLP. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|-...

CVE-2026-73789

creationtimestamp| type| source ---|---|--- 2026-09-10 16:10:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mv6gu7okxp2f...

CVE-2026-88890 OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it, security firm Group-IB said in a report published on September 9. A work profile is a separate space that Android typically reserves for employ...