ROOT-APP-NUGET-CVE-2026-33116 CVE-2026-33116 in System.Security.Cryptography.Xml - Patched by Root

Root has patched CVE-2026-33116 in the System.Security.Cryptography.Xml package for Root:NuGet. Multiple fixed versions available...

USN-8760-2: Linux kernel (NVIDIA) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - User-space API UAPI; - Kernel build system; - ARM32 architecture; - ARM64 architecture; - RISC-V architecture; - S3...

WordPress VikRentItems Flexible Rental Management System plugin < 1.2.4 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin VikRentItems Flexible Rental Management System versions 1.2.4...

USN-8800-1: Linux kernel (NVIDIA BaseOS) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - User-space API UAPI; - Kernel build system; - ARM32 architecture; - ARM64 architecture; - RISC-V architecture; - S3...

USN-8800-1 linux-nvidia-bos vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - User-space API UAPI; - Kernel build system; - ARM32 architecture; - ARM64 architecture; - RISC-V architecture; - S3...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004 WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004 WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.4.6 . The root cause is a flaw in the 'contact_id' parameter, which allows authenticated attackers with contributor-level access or higher to ...

EUVD-2026-84309

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-95828: Session Fixation

A vulnerability was determined in Mstfakts College-Management-System. This affects the function sessionstart of the file Front-end/server.php of the component Authentication. Executing a manipulation can lead to session fixiation. It is possible to launch the attack remotely. The exploit has been...

PT-2026-97117

Name of the Vulnerable Software and Affected Versions itsourcecode Leave Management System version 1.0 Description A remote SQL injection exists in the /module/leavetype/index.php endpoint. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL command...

PT-2026-97108

Name of the Vulnerable Software and Affected Versions Mstfakts College-Management-System affected versions not specified Description A flaw in the Authentication component allows for remote session fixation. This occurs within the session start function located in the Front-end/server.php file...

PT-2026-96993

Name of the Vulnerable Software and Affected Versions HPE Analytics and Location Engine versions 5.0.0.0 and earlier Description A flaw in the internal administrative component allows an unauthenticated remote attacker to obtain unauthorized write access to the file system with elevated privilege...

PT-2026-96843

Name of the Vulnerable Software and Affected Versions Netdata Windows Agent versions 2.0.0 through 2.10.3 Description The MSI repair process launches powershell.exe and wevtutil.exe as elevated interactive processes within the user's desktop session. A low-privileged local user can trigger this...

CVE-2026-76713: Improper Privilege Management

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full syste...

CVE-2026-76709: Improper Access Control

A vulnerability exists in the internal administrative component of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting i...

CVE-2026-76708: Use of Hard-coded Credentials

A vulnerability exists in the Analytics and Location Engine ALE where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in usi...

CVE-2026-96259: Server-Side Request Forgery (SSRF)

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the...

CVE-2026-80152: Improper Neutralization of Special Elements used in an OS Command

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...