PT-2026-68852

Name of the Vulnerable Software and Affected Versions TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.4 Description This issue allows unauthenticated attackers to perform an account takeover by exploiting improper password reset validation. The plugin fails to properly...

CVE-2026-14364: Weak Password Recovery Mechanism for Forgotten Password

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password...

CVE-2026-11430: Incorrect Implementation of Authentication Algorithm

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST...

PT-2026-69111

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin affected versions not specified Description An authentication bypass exists in the webhook token check of the scheduler-webhook plugin. When the webhook feature is enabled but no webhookToken is configured, th...

CVE-2026-14365: Missing Authorization

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-54084

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...

Security Bulletin: IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428

Summary IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-54428 DESCRIPTION: Allocation of resources without limits or throttling in t...

Oracle Linux 10 : kernel (ELSA-2026-49211)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49211 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-214082 CVE-2026-64530 - ksm: use range-walk function to jump over...

CVE-2026-70489

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...

CVE-2026-70489

Technical details about CVE-2026-70489 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-52917

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/openwebui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to...

CLSA-2026-1778028240 TuxCare security update for org.quartz-scheduler (1 CVE)

TuxCare rebuilt 5 org.quartz-scheduler packages to address 1 CVE. Fixed in 1.8.5-tuxcare.1...

PYSEC-2026-3602 Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation

Title: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Summary Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with getverifieduser which rejects pending, while...

PT-2026-67912

Summary In every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...

PT-2026-74685

TuxCare rebuilt 5 org.quartz-scheduler packages to address 1 CVE. Fixed in 1.8.5-tuxcare.1...

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 kernel: tipc: fix double-free in tipcbufappend CVE-2026-52993 kernel: net: sched: UAF via missing handler for TCACTCONSUM...

cups: Fix of CVE-2025-58060

CVE-2025-58060: fix authentication bypass in the scheduler by blocking authentication attempts using a method other than the configured AuthType...

CLEANSTART-2026-OG65548 Security fixes in eks-distro-kube-scheduler 1.35.2-r0

Package eks-distro-kube-scheduler version 1.35.2-r0 fixes 7 vulnerabilities: CVE-2026-46595, CVE-2026-42508, CVE-2026-39821, CVE-2026-33814, CVE-2026-33186...

CLEANSTART-2026-HR76710 Security fixes in eks-distro-kube-scheduler-fips 1.34.3-r0

Package eks-distro-kube-scheduler-fips version 1.34.3-r0 fixes 18 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-27140, CVE-2026-32280...

kernel: net: sched: act_csum: validate nested VLAN headers

A flaw was found in the Linux kernel's network scheduler component. A remote attacker could send specially crafted network packets containing nested Virtual Local Area Network VLAN headers. This could cause the kernel to read beyond allocated memory, leading to a system crash and a denial of...