CLSA-2026-1791685051 TuxCare security update for 21 packages (1 CVE)

TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.26-tuxcare.2...

CLSA-2026-1791680737 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.1-tuxcare.3...

CVE-2026-108737: Weak Password Recovery Mechanism for Forgotten Password

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

nodejs:22 security update

nodejs 1:22.23.2-2 - Patches Pacote CVE and update undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259889 RHEL-255272 1:22.23.2-1 - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-234381 RHEL-234831 RHEL-234896 1:22.23.1-3 - deps:...

CLSA-2026-1791666797 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.1-tuxcare.4...

CLSA-2026-1791666662 TuxCare security update for vm2 (2 CVEs)

TuxCare rebuilt vm2 to address 2 CVEs. Fixed in 3.11.5-tuxcare.7...

CLSA-2026-1791666589 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.2-tuxcare.4...

CLSA-2026-1791666488 TuxCare security update for vm2 (4 CVEs)

TuxCare rebuilt vm2 to address 4 CVEs. Fixed in 3.10.0-tuxcare.7...

CLSA-2026-1791666194 TuxCare security update for adm-zip (2 CVEs)

TuxCare rebuilt adm-zip to address 2 CVEs. Fixed in 0.5.12-tuxcare.3...

CLSA-2026-1791629281 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 3.29.5-tuxcare.7...

CLSA-2026-1791629172 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.2-tuxcare.2...

CLSA-2026-1791629015 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.3-tuxcare.2...

CLSA-2026-1791626582 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.30.1-tuxcare.1...

CLSA-2026-1791626432 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.0-tuxcare.4...

CVE-2026-77183

The FooSales – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes...

CVE-2026-104766

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the OsSettingsController::update handler iterating over attacker-supplied settings parameters...

EUVD-2026-96102

The FooSales – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes...

CVE-2026-104766 Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the OsSettingsController::update handler iterating over attacker-supplied settings parameters...

EUVD-2026-96090

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the OsSettingsController::update handler iterating over attacker-supplied settings parameters...

CVE-2026-104766

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.7.3 . The root cause is that the OsSettingsController::update() handler iterates over attacker-supplied settings parameters without an allowlist...