SUSE CVE-2026-72249

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

PT-2026-79402

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 networking stack where the fib6 rule suppress function drops a suppressed route using ip6 rt put flags but fails to clear the res-rt6 pointer. This causes fib...

PT-2026-79298

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

CVE-2026-54509

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-54508 TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution

TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList and importNaverList in server/src/services/placeService.ts and resolveGoogleMapsUrl in server/src/services/mapsService.ts. The affected sinks call...

CVE-2026-52021

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

GHSA-2223-F22X-24CQ Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...

GHSA-2P39-2JF3-FV2Q next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 — wp2shell Lab Pre-Authentication RCE in W...

CVE-2026-52021

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

PT-2026-79135

An issue in code100xDevs 100xdevs CMS v.1.0 2026-04-30 allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components...

PT-2026-79188

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-52021

100xdevs CMS v1.0 (by code100xDevs) contains an information disclosure vulnerability in the src/middleware.ts and src/app/api/mobile/search/route.ts components, allowing a remote, unauthenticated attacker to obtain sensitive information with no user interaction required. The vulnerability is rate...

CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

EUVD-2026-62422

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::/10 deprecated site-local prefix, Teredo, and other...

CVE-2026-75897

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request...

CVE-2026-75897

OpenSearch Dashboards' capabilities route handler does not bound request payload size, enabling unauthenticated remote attackers to exhaust server resources via a crafted HTTP request, causing denial of service (CVSS 7.5 HIGH). No exploitation observed; AWS security bulletin and download links ar...

EUVD-2026-61064

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request...

GO-2026-6209 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking in github.com/traefik/traefik...

Linux Distros Unpatched Vulnerability : CVE-2026-72421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled but no rule is added, fiblookup performs route lookup directly ...