CVE-2026-84252 click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

CVE-2026-103305 Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors...

CVE-2026-103305

The Prenotazioni WordPress plugin (versions through 1.7.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of authorisation and CSRF checks when saving settings, combined with insufficient escaping of those settings when they are outputted. This allows unauthenticat...

flipperzero-firmware

Flipper Zero Firmware Sito ufficiale di Flipper Zero - Un modo semplice per spiegare ai tuoi amici cosa può fare Flipper Zero. Aggiornamento del firmware di Flipper Zero - Miglioramenti per il tuo delfino: ultime versioni del firmware, strumenti di aggiornamento per PC e dispositivi mobili...

CLSA-2026-1791686070 TuxCare security update for 21 packages (2 CVEs)

TuxCare rebuilt 21 packages to address 2 CVEs. Fixed in 15.5.23-tuxcare.2...

CLSA-2026-1791685051 TuxCare security update for 21 packages (1 CVE)

TuxCare rebuilt 21 packages to address 1 CVE. Fixed in 15.5.26-tuxcare.2...

CLSA-2026-1791680737 TuxCare security update for fastify (1 CVE)

TuxCare rebuilt fastify to address 1 CVE. Fixed in 5.12.1-tuxcare.3...

CVE-2026-108737: Weak Password Recovery Mechanism for Forgotten Password

Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials because TokenManager does not bind tokens to a purpose. Attackers holding a leaked reset link can obtain a full session via /api/session or change...

nodejs:22 security update

nodejs 1:22.23.2-2 - Patches Pacote CVE and update undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259889 RHEL-255272 1:22.23.2-1 - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-234381 RHEL-234831 RHEL-234896 1:22.23.1-3 - deps:...

CLSA-2026-1791666797 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.1-tuxcare.4...

CLSA-2026-1791666662 TuxCare security update for vm2 (2 CVEs)

TuxCare rebuilt vm2 to address 2 CVEs. Fixed in 3.11.5-tuxcare.7...

CLSA-2026-1791666589 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.2-tuxcare.4...

CLSA-2026-1791666488 TuxCare security update for vm2 (4 CVEs)

TuxCare rebuilt vm2 to address 4 CVEs. Fixed in 3.10.0-tuxcare.7...

CLSA-2026-1791666194 TuxCare security update for adm-zip (2 CVEs)

TuxCare rebuilt adm-zip to address 2 CVEs. Fixed in 0.5.12-tuxcare.3...

CLSA-2026-1791629281 TuxCare security update for fastify (2 CVEs)

TuxCare rebuilt fastify to address 2 CVEs. Fixed in 3.29.5-tuxcare.7...

CLSA-2026-1791629172 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.2-tuxcare.2...

CLSA-2026-1791629015 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.3-tuxcare.2...

CLSA-2026-1791626582 TuxCare security update for @modelcontextprotocol/sdk (1 CVE)

TuxCare rebuilt @modelcontextprotocol/sdk to address 1 CVE. Fixed in 1.30.1-tuxcare.1...

CLSA-2026-1791626432 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.0-tuxcare.4...

CVE-2026-77183

The FooSales – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes...