SUSE-SU-2026:20231-1 Security update for cups

This update for cups fixes the following issues: Update to version 2.4.16. Security issues fixed: - CVE-2025-61915: local denial-of-service via cupsd.conf update and related issues bsc1253783. - CVE-2025-58436: slow client communication leads to a possible DoS attack bsc1244057. - CVE-2025-58364:...

Timing Attack

Overview prestashop/prestashop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers. Affected versions of this package are vulnerable to Timing Attack via the login function. An attacker can obtain information about the...

Linux Distros Unpatched Vulnerability : CVE-2026-21985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are 7.1.14 and 7.2.4. Easily...

Linux Distros Unpatched Vulnerability : CVE-2026-21989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are 7.1.14 and 7.2.4. Easily...

WordPress HT Mega - Absolute Addons For Elementor plugin <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget vulnerability

WordPress HT Mega - Absolute Addons For Elementor plugin = 2.4.6 - Authenticated Contributor+ Stored Cross-Site Scripting via Lightbox Widget vulnerability discovered by wesley wcraft in WordPress Plugin HT Mega versions = 2.4.6...

Dummy BacklinkSpeed security vulnerability

Dummy BacklinkSpeed is an SEO automation tool developed by theDummy company. Version 2.4 of Dummy BacklinkSpeed contains a security vulnerability. This vulnerability arises from the possibility of buffer overflows caused by the import of malicious files, which can disrupt the structured exception...

SUSE CVE-2026-24686

go-tuf is a Go implementation of The Update Framework TUF. go-tuf's TAP 4 Multirepo Client uses the map file repository name string repoName as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application...

Astra Linux – Vulnerability in Apache2

Delayed memory release after the effective lifetime vulnerability in the Apache HTTP Server. This issue affects the Apache HTTP Server: from version 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes this issue...

Ubuntu: Security Advisory (USN-7975-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-1417

A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dumpisomrtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and coul...

CVE-2026-1416

A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released...

GPAC code-related vulnerabilities

GPAC is an open-source multimedia framework developed by GPAC. Versions of GPAC prior to 2.4.0 have code vulnerabilities, which stem from a null pointer dereferencing in the file applications/mp4box/filedump.c...

CVE-2025-69317

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This issue affects CarSpot: from n/a through 2.4.6...

CVE-2026-22426

creationtimestamp| type| source ---|---|--- 2026-01-22 17:46:11+00:00| seen| https://gist.github.com/Darkcrai86/1dd9289803bef694101f7f5241b901ce...

CVE-2026-24357

Missing Authorization vulnerability in Brecht WP Recipe Maker wp-recipe-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Recipe Maker: from n/a through = 10.2.4...

CVE-2025-67964

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through = 2.4.3...

CVE-2026-24379

CVE-2026-24379 : The WP Job Portal plugin for WordPress (WP Job Portal, plugin slug wp-job-portal) has an insecure direct object reference (IDOR) vulnerability in versions up to and including 2.4.3. The issue is described as an authorization bypass via a user-controlled key, allowing improper acc...

CVE-2025-69318

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hossni Mubarak JobWP jobwp allows Stored XSS.This issue affects JobWP: from n/a through = 2.4.5...

PT-2026-4221

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in pavothemes Triply triply allows PHP Local File Inclusion.This issue affects Triply: from n/a through = 2.4.7...

PT-2026-4220

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in pavothemes Freshio freshio allows PHP Local File Inclusion.This issue affects Freshio: from n/a through = 2.4.2...