CVE-2026-114387 Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

CVE-2026-114387 Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

CVE-2026-114387

Shopper versions 2.0.0 before 2.6.0 are vulnerable to a privilege escalation flaw due to missing authorization in Livewire components. Users with only access_dashboard privileges can bypass intended restrictions by directly calling CreateTeamMember::store() or Permissions::togglePermission() via ...

CLSA-2026-1792585696 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 8 CVEs. Fixed in 6.0.11-tuxcare.6...

CLSA-2026-1792585518 TuxCare security update for org.springframework (8 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 8 CVEs. Fixed in 6.0.12-tuxcare.6...

CLSA-2026-1792584150 TuxCare security update for org.springframework (5 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 5 CVEs. Fixed in 6.1.13-tuxcare.4...

CLSA-2023-1682604577 Fix of 54 CVEs

CVE-2022-1198 - drivers: hamradio: 6pack: fix UAF bug caused by modtimer Bionic update: upstream stable patchset 2022-03-04 LP: 1963717 // CVE-2020-36516 - ipv4: avoid using shared IP generator for connected sockets CVE-2022-36879 - xfrm: xfrmpolicy: fix a possible double xfrmpolsput in...

CLSA-2026-1792577892 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 26 org.springframework packages to address 2 CVEs. Fixed in 6.2.13-tuxcare.4...

CLSA-2026-1792576955 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 26 org.springframework packages to address 2 CVEs. Fixed in 6.2.5-tuxcare.3...

CLSA-2026-1792575333 TuxCare security update for org.springframework (34 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 34 CVEs. Fixed in 5.1.7.RELEASE-tuxcare.1...

CLSA-2026-1792575257 TuxCare security update for 36 packages (32 CVEs)

TuxCare rebuilt 36 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1...

CLSA-2026-1792574765 TuxCare security update for @modelcontextprotocol/sdk (2 CVEs)

TuxCare rebuilt @modelcontextprotocol/sdk to address 2 CVEs. Fixed in 1.30.1-tuxcare.2...

CLSA-2026-1778261513 Fix CVE(s): CVE-2026-43284

Miscellaneous Ubuntu changes - Packaging: add tuxcare suffix Miscellaneous upstream changes - xfrm: esp: avoid in-place decrypt on shared skb frags - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present...

CLSA-2025-1747430081 Fix of 47 CVEs

CVE-url: https://ubuntu.com/security/CVE-2021-47352 - virtio-net: Add validation for used length CVE-url: https://ubuntu.com/security/CVE-2024-46745 - Input: uinput - reject requests with unreasonable number of slots CVE-url: https://ubuntu.com/security/CVE-2024-44952 - driver core: Fix ueventsho...

CLSA-2023-1693432495 Fix of 8 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-4128 - net/sched: clsu32: No longer copy tcfresult on update to avoid use-after- free - net/sched: clsfw: No longer copy tcfresult on update to avoid use-after- free - net/sched: clsroute: No longer copy tcfresult on update to avoid use- after-free...

Important: Red Hat Security Advisory: dogtag-pki security update

An update for dogtag-pki is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

WordPress Download Manager plugin < 3.3.71 - Privacy Settings Update vulnerability

Privacy Settings Update vulnerability discovered by Kartik Sharma in WordPress Plugin Download Manager versions 3.3.71...

WordPress Download Manager plugin 4.0.0-7.5.8 - Privacy Settings Update vulnerability

Privacy Settings Update vulnerability discovered by Kartik Sharma in WordPress Plugin Download Manager versions 4.0.0-7.5.8...

CVE-2026-110982 AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...

CVE-2026-110982 AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as...