CVE-2026-71862: Exposure of Sensitive Information to an Unauthorized Actor

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

PT-2026-79425

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

WordPress wpForo Forum plugin < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment vulnerability

Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin wpForo Forum versions 3.1.3...

postfix: buffer over-read via malformed enhanced status code

A flaw was found in Postfix. This issue occurs when processing enhanced status codes, specifically an enhanced status code that lacks text following the third number. Depending on the configuration of the server, this allows a remote attacker to cause a buffer over-read of only 1 byte, leading to...

Important: Red Hat Security Advisory: postfix security update

An update for postfix is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

MINI-G44C-VQ83-PHJ6

Bulletin has no description...

MINI-2P6G-V58H-J5CH

Bulletin has no description...

CVE-2026-76208

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...

CVE-2026-76208 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...

CVE-2026-76208 phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...

CVE-2026-76208

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass in AuthLdap::create(). When LDAP authentication is enabled, a successful LDAP bind unconditionally calls User::setStatus('active'), overwriting a pre-existing local account's status from blocked to active . This allows an admi...

MINI-3PJ3-VGQF-P5QJ

Bulletin has no description...

CVE-2026-49426

When auditing a system call executed via ptracePTSCREMOTE, the kernel passed the return value of an internal setup function to AUDITSYSCALLEXIT rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect t...

CVE-2026-18777

The TrueBooker WordPress plugin (versions before 1.2.7 ) is vulnerable to an unauthenticated arbitrary appointment status change due to improper authorization checks in an AJAX action (specifically the update_appointment_status functionality). An unauthenticated attacker can exploit this flaw to ...

CVE-2026-18777 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

EUVD-2026-62282

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

PT-2026-78390

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the account status column of a pre-existing local...

CVE-2026-76208: Insufficient Logging

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the accountstatus column of a pre-existing local...

MLflow Server-Side Request Forgery Vulnerability

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive responsestatus and responsebody...

PT-2026-78296

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...