CVE-2026-65985 FUXA: SSRF hardening for `device-webapi-request`

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

EUVD-2026-55220

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

CLSA-2026-1775608289 TuxCare security update for ini (1 CVE)

TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.3-tuxcare.1...

EUVD-2026-49248

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

CVE-2026-66448 WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

CVE-2026-66448

WordPress Gallery PhotoBlocks plugin ≤ 1.3.3 has a Cross Site Scripting (XSS) vulnerability in contributor contexts. Affected product: Gallery PhotoBlocks plugin for WordPress (versions up to 1.3.3). Root cause details are not provided in the documents. CVSSv3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:...

WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Sharief in WordPress Plugin Gallery PhotoBlocks versions = 1.3.3...

EUVD-2026-48138

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

CVE-2026-65537 WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

CVE-2026-65537

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

CVE-2026-65537

CVE-2026-65537 concerns a WordPress plugin, Cyr to Lat reloaded – transliteration of links and file names , affected in versions

CVE-2026-65537 WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Cyr to Lat reloaded – transliteration of links and file names versions = 1.3.3...

PT-2026-63948

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

OPENSUSE-SU-2026:11297-1 oras-1.3.3-2.1 on GA media

These are all security issues fixed in the oras-1.3.3-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-58518

Cross-Site request forgery CSRF vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from before 1.3.3...

OPENSUSE-SU-2026:11123-1 jupyter-nbclassic-1.3.3-2.1 on GA media

These are all security issues fixed in the jupyter-nbclassic-1.3.3-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-41049

Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them...

EUVD-2026-38275

Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them...

CVE-2026-41049 Caching of Authentication allows Authentication Bypass between users in qSnapper

Incorrect caching of authentication between different users of the qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them...