PT-2026-104550

Name of the Vulnerable Software and Affected Versions Burst Statistics – Simple WordPress Analytics Google Analytics Alternative versions prior to 3.7.2 Description Improper authentication allows for account persistence. The maybe load shared dashboard handler issues a genuine WordPress session...

PT-2026-104571

Name of the Vulnerable Software and Affected Versions Linux Mint Xreader versions prior to 4.6.10 Description A path traversal issue exists in the PDF Attachment Saving Handler component within the g file get child function of the shell/ev-window.c file. A remote attacker can manipulate the...

PT-2026-104497

Name of the Vulnerable Software and Affected Versions WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons versions prior to 4.7.4 Description Unauthenticated attackers can extract sensitive customer data for any arbitrary email address on a site. This includes the customer name,...

PT-2026-104477

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-32 ImageMagick versions prior to 6.9.13-57 Description A security policy bypass exists in the LoadPolicyCache function. This occurs when the policy.xml file utilizes an alternate DOCTYPE that does not end in...

PT-2026-104538

Name of the Vulnerable Software and Affected Versions WP Ultimate Review versions prior to 2.4.4 Description Authenticated users with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do...

PT-2026-104476

Name of the Vulnerable Software and Affected Versions OpenAPV versions prior to 1.1.1.0 Description A heap-based buffer overflow occurs in the read bitstream function. A buffer overflow is a condition where a program writes more data to a block of memory the buffer than it is allocated to hold,...

PT-2026-104500

Name of the Vulnerable Software and Affected Versions Photo Reviews for WooCommerce versions prior to 1.2.31 Description An issue allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments. The flaw occurs because the plugin stores...

PT-2026-104504

Name of the Vulnerable Software and Affected Versions GeoDirectory versions prior to 2.8.187 Description Insufficient escaping and a lack of numeric validation on coordinate values when saving a listing allow authenticated attackers with Subscriber-level access or higher to perform SQL Injection...

StegoMemory: Agentic Memory Acts As Covert Steganographic Channel

Is agentic memory robust against stealthy steganographic attacks? We carry out a large-scale red-teaming exercise to test whether agents can encode attacker-controlled strings in one session and recover them in another without triggering safety oversight. Following SHADE-Arena-style tasks, we emb...

PT-2026-104570

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description An issue exists in the BLS12 381BasicScheme.keyValidate function, affecting BLSPublicKeyParameters and the verify and aggregateVerify methods of BasicScheme, MessageAugmentation, and...

PT-2026-104569

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86 Description Validation of an MLS RFC 9420 external commit's proposal list in the validateExternalCachedProposals function of org.bouncycastle.mls.protocol.Group failed to verify that a removed leaf...

PT-2026-104540

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.20 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This...

PT-2026-104543

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.19 Description The plugin is susceptible to Local File Inclusion, a flaw that allows an attacker to include files from the local server. Authenticated...

Security update for rustup (important)

openSUSE security update: security update for rustup ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22016-1 Rating: important References: bsc1230032 bsc1243862 bsc1249008 bsc1257902 bsc1270186 bsc1270521 bsc1270619 bsc1270644 bsc1270795 bsc1270870...

Linux Distros Unpatched Vulnerability : CVE-2026-18040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF2^8 arithmetic used lookup tables indexed by field...

Linux Distros Unpatched Vulnerability : CVE-2026-103227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the...

Linux Distros Unpatched Vulnerability : CVE-2026-85493

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgra...

PT-2026-104547

Name of the Vulnerable Software and Affected Versions WPFront Notification Bar versions prior to 3.5.2 Description Reflected Cross-Site Scripting occurs when the write debug logs debug-log output path reflects the raw value of the $ SERVER'REQUEST URI' variable through the vprintf function within...

Linux Distros Unpatched Vulnerability : CVE-2026-94636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in...

CVE-2026-104433 Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all...