GHSA-CJ75-F6XR-R4G7 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, pghero, pghero-fips, ruby4.0-rails, ruby3.3-rails...

CVE-2026-12421

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

USN-8575-2: Linux kernel vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

USN-8595-1 linux-oracle-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

USN-8593-1: Linux kernel vulnerabilities

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. CVE-2025-54518 Several security issues...

CVE-2026-14291

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

CVE-2026-9713

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

RLSA-2026:41901 Important: .NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29...

CVE-2026-14291

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

CVE-2026-14291

The CVE-2026-14291 entry concerns the security-ninja-premium WordPress plugin (before 5.290). The issue is that one of the two-factor authentication (2FA) code paths does not verify the second factor, enabling an unauthenticated attacker who knows a user’s password to complete authentication with...

CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

EUVD-2026-47885

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...

CVE-2026-7120

The CVE-2026-7120 issue affects @fastify/static (versions up to and including 10.1.1). The root cause is that allowedPath is evaluated before normalizing dot segments and duplicate separators in the request pathname, allowing an unauthenticated attacker to bypass path-based filtering by using equ...

CVE-2026-60368

creationtimestamp| type| source ---|---|--- 2026-07-23 01:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbn5xyb2r2q 2026-07-23 04:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbxafd5kr2a 2026-07-23 16:52:52+00:00| seen|...

SUSE CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

CVE-2026-60455

creationtimestamp| type| source ---|---|--- 2026-07-23 00:52:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbmpjs7sj2q 2026-07-23 01:00:36+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbn6chrjh22 2026-07-23 17:17:14+00:00| seen|...

CVE-2026-60373

creationtimestamp| type| source ---|---|--- 2026-07-23 00:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbjuumq222d 2026-07-23 01:05:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbngwj6ip2i 2026-07-23 17:23:15+00:00| seen|...

CVE-2026-60371

creationtimestamp| type| source ---|---|--- 2026-07-23 00:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrbjtchhw62x 2026-07-23 01:15:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrbnytie5e23 2026-07-23 16:52:59+00:00| seen|...