CVE-2026-87004: Improper Verification of Cryptographic Signature

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/authoidcprovider.py decodes the idtoken returned by the identity provider's token endpoint using jose.jwt.getunverifiedclaims...

CentOS Linux 7 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (CENTOS7:CLSA-2026:1778662564)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1778662564 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon...

AlmaLinux 9.2 [TuxCare] Security Update: grafana (ALMALINUX9.2:CLSA-2025:1758135826)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758135826 advisory. - Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is ma...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2026:1770647876)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1770647876 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus h...

Linux Distros Unpatched Vulnerability : CVE-2026-47566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leadin...

CentOS Linux 8 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS-STREAM8:CLSA-2025:1757663410)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1757663410 advisory. - Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operation...

CentOS Linux 8 [TuxCare] Security Update: git / git-all / git-core-doc / git-credential-libsecret / etc (CENTOS-STREAM8:CLSA-2025:1749743573)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1749743573 advisory. - Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transport...

PT-2026-103022

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

PT-2026-103070

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

CVE-2026-96347: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

CVE-2026-75823: Improper Privilege Management

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

PT-2026-103296

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810...

PT-2026-103095

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not...

CVE-2026-102587: Observable Response Discrepancy

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure...

CVE-2026-102093: Improper Privilege Management

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full...

PT-2026-103310

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored HTML injection is possible through the User-Agent header. Recommendations Update to version 2026.2.18991...

CVE-2026-100263: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-97347: Improper Neutralization of Input During Web Page Generation

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

KLA91311 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A...

KLA91310 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A...