CVE-2026-67578: Missing Authentication for Critical Function

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

JetBrains TeamCity < 2019.1.4 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2019.1.4. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. CVE-2019-18364 - In JetBrains TeamCity...

JetBrains TeamCity < 2021.1.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.1.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project. CVE-2021-43201 - In JetBrains TeamCity...

WordPress Dokan plugin < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability

Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability discovered by Usama Arshad in WordPress Plugin Dokan versions 5.0.14...

firefox: Privilege escalation in the Remote Settings Client component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Remote Settings Client component...

firefox: Privilege escalation in the Remote Settings Client component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Remote Settings Client component...

firefox: Privilege escalation in the Remote Settings Client component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Remote Settings Client component...

dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

[SECURITY] [DLA 4753-1] nvidia-graphics-drivers new upstream security update

Debian LTS Advisory DLA-4753-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost August 24, 2026 https://wiki.debian.org/LTS Package : nvidia-graphics-drivers Version : 535.309.01-0+deb12u1 CVE ID : CVE-2025-23280 CVE-2025-23282 CVE-2025-23300 CVE-2025-23330...

dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

PT-2026-81266

Name of the Vulnerable Software and Affected Versions My Agile Privacy® – CMP, Cookie Consent & Privacy Tools versions prior to 3.3.7 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows...

CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

CVE-2026-5093

The GreenShift – Animation and Page Builder Blocks plugin for WordPress (versions up to and including 12.8.9 ) is vulnerable to unauthorized modification of data due to a missing capability check on the gspb_update_global_wp_settings function. The function only verifies the edit_posts capability ...

CVE-2026-5093 Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspbupdateglobalwpsettings' function that only verifies the 'editposts' capability...

WordPress Greenshift – animation and page builder blocks plugin <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification vulnerability

Authenticated Contributor+ Theme Settings Modification vulnerability discovered by Raihan Adi Arba in WordPress Plugin Greenshift versions = 12.8.9...

PT-2026-79502

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.25 Description The plugin is susceptible to unauthorized data modification leading to privilege escalation. This occurs because the wpematico import settings function lacks a proper capability...

CVE-2026-76876

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

CVE-2026-76876 Craftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

EUVD-2026-64068

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...