GHSA-CJ75-F6XR-R4G7 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.4-rails, gitlab-rails-ce, pghero, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee, pghero-fips, ruby4.0-rails...

WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Social Ninja versions = 4.3.0...

EUVD-2026-47888

A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...

WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin Dokan Pro versions = 5.0.3...

[SECURITY] Fedora 43 Update: kernel-7.1.4-104.fc43

The kernel meta package...

[SECURITY] Fedora 43 Update: fractal-14.1-1.fc43

Fractal is a Matrix messaging app for GNOME written in Rust. Its interface is optimized for collaboration in large groups, such as free software projects...

[SECURITY] Fedora 43 Update: srt-1.5.6-1.fc43

Secure Reliable Transport SRT is an open source transport technology that optimizes streaming performance across unpredictable networks, such as the Internet...

[SECURITY] Fedora 43 Update: libssh-0.11.5-1.fc43

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, trans fer files, use a secure and transparent tunnel for your remote...

CVE-2026-60368

creationtimestamp| type| source ---|---|--- 2026-07-23 01:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbn5xyb2r2q 2026-07-23 04:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbxafd5kr2a 2026-07-23 16:52:52+00:00| seen|...

CVE-2026-61246

creationtimestamp| type| source ---|---|--- 2026-07-23 00:56:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbmwaws4w2b 2026-07-23 01:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbn6kcks22w 2026-07-23 01:48:05+00:00| seen|...

PT-2026-63885

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

PT-2026-63825

Unauthenticated Cross Site Scripting XSS in Coaching = 3.9.2 versions...

PT-2026-63933

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

PT-2026-63884

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

PT-2026-63595

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc event filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

PT-2026-64169

Name of the Vulnerable Software and Affected Versions Johnson Controls CCure 9000 and victor application server versions 2.9 through 3.0 Description A Server Side Request Forgery SSRF issue exists in the Victor application server. SSRF is a flaw that allows an attacker to induce the server-side...

PT-2026-63886

Unauthenticated Cross Site Request Forgery CSRF in GiveWP = 4.16.3 versions...

PT-2026-63883

Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...

PT-2026-63852

Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...

PT-2026-64135

Summary The execute code tool's subprocess sandbox advertises a three-layer defense AST validation, text-pattern blocklist, restricted builtins . In sandbox mode the default only two layers are active — the text-pattern blocklist is skipped — and both remaining layers are bypassed by combining tw...