CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-71891

A flaw was found in Bouncy Castle. When validating Boneh-Lynn-Shacham BLS signature public keys, the library does not verify that a key is constructed on the canonical elliptic curve. An attacker can exploit this issue by supplying a specially crafted public key defined on an alternate curve. Thi...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.3 Vulnerability Details CVEID:CVE-2026-33557 DESCRIPTION: A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to...

EUVD-2026-92478

Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspaceslug/projects/projectid/members/memberpk/ to change another user's project role. The role-update logic blocks...

CVE-2026-104893

The project management tool Plane is vulnerable to improper validation in its API. Prior to version 1.4.0 , an authenticated user can use the PATCH /api/users/api-tokens/{token_id}/ endpoint to modify the allowed_rate_limit field without server-side validation or a maximum limit. This allows an a...

CVE-2026-59788

A flaw was found in Zabbix. The application fails to properly validate the URL scheme of the authorization endpoint in the email media type OAuth form. An attacker can provide a specially crafted configuration file containing a malicious script link. When a privileged administrator attempts to...

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

EUVD-2026-92433

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware . This flaw allows for a potential CRITICAL impact on confidentiality, integrity, and availability. While the CVSS score indicates a high attack complexity and a changed scope, specific technical d...

Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: CVE-2026-78807: Security bypass via missing PMKSA validation bsc1280914. Fixed incomplete RADIUS Message-Authenticator attribute validation in hostapd Patch Instructions: To install this SUSE update use the SUSE recommended installation...

SUSE-SU-2026:4494-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: - CVE-2026-78807: Security bypass via missing PMKSA validation bsc1280914. - Fixed incomplete RADIUS Message-Authenticator attribute validation in hostapd...

BIT-MOODLE-2026-102585 Moodle: group validation missing when enrolling user to course

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate the dataoffset and datalength fields of the smbdirectdatatransfer structure. If the dataoffset and datalength fields of the smbdirectdatatransfer structure are invalid, an out-of-bounds issue may occur...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Added an array index check for hdcp ddc access. Reason Coverity reports an OVERRUN warning. Do not check if the array index is valid. How Check that the msgid is valid and that the array index is valid...

Astra Linux – Vulnerability in WebKit2GTK

A memory corruption issue has been resolved through improved input validation. This issue is fixed in Safari 18.1, iOS 18.1, iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, and watchOS 11.1. Processing maliciously crafted web content may lead to an unexpected process crash...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: smb: client: fixed potential OOBs in smb2ParseContexts Validated offsets and lengths before dereferencing to create contexts in smb2ParseContexts. This fix addresses the following OOPs when accessing invalid create contexts fr...

Astra Linux – Vulnerability in Python-Django

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are vulnerable to a ReDoS regular expression denial of service attack due to a very large number of domain name labels for emails and URLs...