PT-2026-103672

Name of the Vulnerable Software and Affected Versions WP Popular Posts versions prior to 7.4.3 Description An issue exists where unauthenticated attackers can extract sensitive information from non-public post objects, such as wp block synced patterns, which are typically protected by WordPress...

PT-2026-103666

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments versions prior to 1.6.12.33 Description An issue exists that allows unauthenticated attackers to extract customer personally identifiable information PII, such as names, email addresses, phone numbers, and custom...

PT-2026-104068

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to manipulate configurations of devices they do not own. This issue enable...

CVE-2026-92245: Missing Authorization

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

AlmaLinux 9.6 [TuxCare] Security Update: coreutils / coreutils-common / coreutils-single (ALMALINUX9.6:CLSA-2026:1783532249)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783532249 advisory. - A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access...

AlmaLinux 9.2 [TuxCare] Security Update: coreutils / coreutils-common / coreutils-single (ALMALINUX9.2:CLSA-2026:1783530353)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783530353 advisory. - A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (crlsa-2025_10676)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510676 advisory. net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 Tenable has extracted the preceding description block directly from the...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc Multiple Vulnerabilities (crlsa-2025_3772)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20253772 advisory. golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints CVE-2024-45341 golang: net/http: net/http: sensitive headers...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2020_4272)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204272 advisory. nodejs-dot-prop: prototype pollution CVE-2020-8116 nodejs: HTTP request smuggling due to CR-to-Hyphen conversion CVE-2020-8201 npm: Sensitive information...

Rocky Linux 8 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_25918)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202625918 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2026-28946 webkitgtk: Processing maliciously crafted web...

AlmaLinux 9.2 [TuxCare] Security Update: squid (ALMALINUX9.2:CLSA-2026:1778252773)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778252773 advisory. - An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposu...

CVE-2026-64892: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3b63...

CVE-2026-71449: Use of Hard-coded Cryptographic Key

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-56589: Improper Neutralization of Input During Web Page Generation

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data...

PT-2026-103856

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

PT-2026-103855

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

PT-2026-103836

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

PT-2026-103694

Name of the Vulnerable Software and Affected Versions BackupSheep WordPress Backup Plugin versions prior to 1.9 Description The plugin fails to properly validate its integration key, treating a blank or unset key as valid. This allows unauthenticated attackers to access backup and export endpoint...

CVE-2026-103336: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

PT-2026-104023

Name of the Vulnerable Software and Affected Versions EasyIO FS32 versions prior to 3.0b63 Description Johnson Controls EasyIO FS32 contains a hard-coded cryptographic key, which is a fixed secret used for encryption or decryption. This flaw allows an attacker to retrieve embedded sensitive data...