OESA-2026-3156 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: drbd: add missing krefget in handlewriteconflicts With two-primaries enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even i...

CVE-2026-57370

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

CVE-2026-57370 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

CVE-2026-57370

Summary (CVE-2026-57370): Unauthenticated reflected Cross Site Scripting (XSS) in WordPress plugin Visitor Traffic Real Time Statistics Pro versions

CVE-2026-57370 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

EUVD-2026-48163

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

CVE-2026-57370: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

PT-2026-63821

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

EUVD-2026-46963

Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft component: Higher Ed Statistics Agency - UK HESA. The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2026-60605: Missing Authentication for Critical Function

Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft component: Higher Ed Statistics Agency - UK HESA. The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

CVE-2026-64121

A flaw was found in the Linux kernel's Intermediate Functional Block ifb network device. A local user with network configuration privileges can trigger a slab-out-of-bounds read by configuring an asymmetric ifb device and querying its ethtool statistics. This vulnerability can lead to a kernel...

CVE-2026-64121 net: ifb: report ethtool stats over num_tx_queues

In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over numtxqueues ifbdevinit allocates dp-txprivate to dev-numtxqueues entries via kzallocobjstxp, dev-numtxqueues. Both IFB per-queue RX and TX stats live in those entries: ifbxmit updates txp-rxsta...

CVE-2026-64036 cgroup/rstat: validate cpu before css_rstat_cpu() access

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a...

CVE-2026-43977

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exis...

Exploit for CVE-2026-8181

CVE-2026-8181 - Burst Statistics WordPress Exploit Tools expl...

EUVD-2026-43547

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the...

CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

Apache Superset allows authenticated users to view sensitive data without explicit permissions

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint disabled by default allows users to retrieve a list of objects associated with a specific tag.When these associated objects include Users, the AP...

PYSEC-2026-2375 Apache Superset allows authenticated users to view sensitive data without explicit permissions

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint disabled by default allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the A...

PT-2026-59055

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint disabled by default allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the A...