EUVD-2025-210726

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of GetFileWithoutZip method. The issue results from th...

ServiceNow - Incomplete Input Validation

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addresse...

The vulnerability of the dpaa2-switch component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the dpaa2-switch component in the Linux operating system is related to incorrect checking of the specified index, position, or offset in the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the `arch/arm64/kernel/hibernate.c` component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability in the arch/arm64/kernel/hibernate.c component of the Linux operating system relates to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

Oracle Linux 8 : bind (ELSA-2026-54654)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54654 advisory. - Validate NSEC3 signer matches owning zone CVE-2026-10723 - Prevent accepting unsigned NSEC/NSEC3 records CVE-2026-13204 - Reject out-of-zone NSEC...

RockyLinux 8 : bind9.16 (RLSA-2026:54509)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54509 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

RHEL 8 : Red Hat OpenStack Platform 16.2 security advisory (Important) (RHSA-2026:54757)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:54757 advisory. Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service...

PT-2026-71995

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13 Description The getgrav/grav-plugin-api plugin fails to validate that the scopes of a newly created API key are a subset of the caller's scopes within the createApiKey function. The self-target...

AlmaLinux 8 : bind9.16 (ALSA-2026:54509)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54509 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-133...

Oracle Linux 8 : bind9.16 (ELSA-2026-54509)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54509 advisory. - Fix NSEC3 signer validation CVE-2026-10723 - Reject out-of-zone NSEC next owner names CVE-2026-13321 - Fix CVE-2026-11622: reference-counted DNS cac...

VulnCheck KEV: CVE-2026-58231

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...

PT-2026-72122

Name of the Vulnerable Software and Affected Versions Laravel Socialite affected versions not specified Description The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in...

Security Updates for Azure CycleCloud < 8.9.1

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities: - Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. CVE-2026-57969 - An improper input...

AlmaLinux 8 : bind (ALSA-2026:54654)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54654 advisory. bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field CVE-2026-13321 bind: bind9: Potential memory usage beyond configured limits...

IBM Informix Dynamic Server 12.10.x / 14.10.x < 14.10.xC13W13 / 15.0.x < 15.0.1.13 RCE (7282827)

The version of IBM Informix Dynamic Server installed on the remote host is 12.10.x, or 14.10.x prior to 14.10.xC13W13, or 15.0.x prior to 15.0.1.13. It is, therefore, affected by a remote code execution vulnerability in the IBM Informix Wire Listener as referenced in the 7282827 vendor advisory. ...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

Important: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory

An update for Red Hat OpenStack Platform 16.2 Train is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied projectid for an EC2-type credential was not validated against the project of the authenticating...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...