CVE-2026-75824: Improper Access Control

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

PT-2026-103023

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

CVE-2026-103446: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46...

CVE-2026-83560: Exposure of Sensitive Information to an Unauthorized Actor

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

Linux Distros Unpatched Vulnerability : CVE-2026-101333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the...

Rocky Linux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1774258892)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774258892 advisory. - Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled ou...

AlmaLinux 9.2 [TuxCare] Security Update: open-vm-tools / open-vm-tools-desktop / open-vm-tools-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1750444475)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1750444475 advisory. - VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation...

PT-2026-103093

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw exists where the application fails to verify if a selected group belongs to a specific course during the user enrollment process. An authenticated user with teacher privileges can explo...

PT-2026-103127

sogo yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...

CVE-2026-74864: Authorization Bypass Through User-Controlled Key

sogoyhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...

CVE-2026-103231: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-87004: Improper Verification of Cryptographic Signature

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/authoidcprovider.py decodes the idtoken returned by the identity provider's token endpoint using jose.jwt.getunverifiedclaims...

CentOS Linux 7 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS7:CLSA-2026:1778662564)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778662564 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1758135826)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758135826 advisory. - Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is ma...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2026:1770647876)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1770647876 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus h...

Linux Distros Unpatched Vulnerability : CVE-2026-47566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leadin...

CentOS Linux 8 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS-STREAM8:CLSA-2025:1757663410)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1757663410 advisory. - Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operation...

CentOS Linux 8 [TuxCare] Security Update: git / git-all / git-core-doc / git-credential-libsecret / etc (CENTOS-STREAM8:CLSA-2025:1749743573)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1749743573 advisory. - Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transport...

PT-2026-103022

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

PT-2026-103070

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...