CVE-2026-18437

CVE-2026-18437 affects the MailerPress WordPress plugin (versions

CVE-2026-18437 MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates

The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to...

CVE-2026-18206

CVE-2026-18206 affects Keycloak’s keycloak-services component. A realm administrator using a wildcard domain (for example, *.example.com) to restrict hosts that can register or update clients is bypassable due to improper validation: any hostname ending with the domain suffix is accepted even if ...

WordPress MailerPress – Newsletter, email marketing & AI automation plugin <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates vulnerability

Missing Authorization to Unauthenticated Contact Updates vulnerability discovered by Jakub Lipiński A3RES in WordPress Plugin MailerPress versions = 1.5.0...

SUSE CVE-2026-59691

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit...

CVE-2026-67347

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

CVE-2026-67347

Vendure 3.7.1 contains a cross-channel authorization bypass. In stock-location.service.ts and asset.service.ts update methods, channel-scoped administrators can supply global IDs from different channels to overwrite inventory locations or catalog assets belonging to other tenants, bypassing chann...

Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: Version 1.3.6: When masking directories with maskPaths, runc will now re- use a...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-14631 DESCRIPTION:...

CVE-2026-44103

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...

CLEANSTART-2026-VK07836 Security fixes in terragrunt-fips 0.94.0-r3

Package terragrunt-fips version 0.94.0-r3 fixes 13 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32283...

CLEANSTART-2026-AG72507 Security fixes in dex 2.45.1-r3

Package dex version 2.45.1-r3 fixes 6 vulnerabilities: CVE-2026-46595, CVE-2026-42508, CVE-2026-39834, CVE-2026-39821, CVE-2026-25680...

CLEANSTART-2026-AA33839 Security fixes in activemq 6.2.3-r1

Package activemq version 6.2.3-r1 fixes 10 vulnerabilities: CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-22745, CVE-2026-22741...

CLEANSTART-2026-QN68353 Security fixes in spark-sc213-jdk17-py312 4.0.3-r0

Package spark-sc213-jdk17-py312 version 4.0.3-r0 fixes 10 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, ghsa-3g76-f9xq-8vp6...

CLEANSTART-2026-WN87351 Security fixes in temporal-server-fips 1.29.6-r0

Package temporal-server-fips version 1.29.6-r0 fixes 13 vulnerabilities: ghsa-9jj7-4m8r-rfcm, ghsa-mh2q-q3fh-2475, ghsa-p77j-4mvh-x3m3, ghsa-78h2-9frx-2jm8, ghsa-hfvc-g4fc-pqhx...

CLEANSTART-2026-RT51509 Security fixes in mockgen 0.6.0-r1

Package mockgen version 0.6.0-r1 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-OK10530 Security fixes in druid-exporter-fips 0.11-r4

Package druid-exporter-fips version 0.11-r4 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

EUVD-2026-51038

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...

CVE-2026-44103

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This...

gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit...