CLSA-2026-1774484507 TuxCare security update for minimatch (4 CVEs)

TuxCare rebuilt minimatch to address 4 CVEs. Fixed in 3.0.4-tuxcare.1...

CLEANSTART-2026-RY66554 Security fixes in grafana-mimir-fips 3.0.4-r1

Package grafana-mimir-fips version 3.0.4-r1 fixes 1 vulnerabilities: CVE-2026-34986...

CLEANSTART-2026-ZY02248 Security fixes in cosign 3.0.4-r0

Package cosign version 3.0.4-r0 fixes 1 vulnerabilities: ghsa-59jp-pj84-45mr...

PT-2026-63541

Name of the Vulnerable Software and Affected Versions PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 through 3.2.0 Description A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails t...

PYSEC-2026-1185 Apache Superset: Improper Neutralization of custom SQL on embedded context

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, whi...

PYSEC-2026-730 Plone Cross-site Scripting vulnerability in the LiveSearch module

Cross-site scripting XSS vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag...

CVE-2026-56032

The CVE-2026-56032 entry concerns a PHP Object Injection vulnerability in the WordPress BuddyBoss Platform plugin, affecting versions up to 3.0.4. The root cause is described as Subscriber PHP Object Injection within BuddyBoss Platform <= 3.0.4. Documented in Patchstack and CVE records, the vu...

EUVD-2026-39695

Subscriber PHP Object Injection in Buddyboss Platform = 3.0.4 versions...

CVE-2026-56032 WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Buddyboss Platform = 3.0.4 versions...

CVE-2026-40798

WPForo Forum plugin for WordPress &lt;= 3.0.4 is affected by an unauthenticated SQL injection vulnerability. The CVE entry cites unauthenticated SQL Injection in wpForo Forum &lt;= 3.0.4, with CVSSv3.1 base score 9.3 (CRITICAL) and impact TIC: Confidentiality High, Availability Low, no privileges...

CVE-2026-42676

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in myCred allows Stored XSS. This issue affects myCred: from n/a through 3.0.4...

WordPress myCred plugin <= 3.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by thevietronin in WordPress Plugin myCred versions = 3.0.4...

WordPress JS Help Desk - AI-Powered Support & Ticketing System plugin <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter vulnerability

WordPress JS Help Desk - AI-Powered Support & Ticketing System plugin = 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin JS Help Desk versions = 3.0.4...

CVE-2026-2511 JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the multiformid parameter in the storeTickets function in all versions up to, and including, 3.0.4. This is due to the user-supplied multiformid value being passed to escsql without...

ewe 安全漏洞

ewe is a lightweight web server build package developed by Vladislav Shakitskiy. Versions of ewe 3.0.4 and earlier contained security vulnerabilities; these vulnerabilities stemmed from an infinite loop in the handletrailers function, which could lead to a denial-of-service attack...

CVE-2026-1801 affecting package libsoup for versions less than 3.0.4-13

CVE-2026-1801 affecting package libsoup for versions less than 3.0.4-13. A patched version of the package is available...

CVE-2025-69388

CVE-2025-69388 affects WordPress Cliengo – Chatbot plugin

PT-2026-21169

Name of the Vulnerable Software and Affected Versions Cliengo – Chatbot versions through 3.0.4 Description An authorization issue exists in Cliengo – Chatbot, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update Cliengo – Chatbot to a version...

OPENSUSE-SU-2026:10232-1 cosign-3.0.4-2.1 on GA media

These are all security issues fixed in the cosign-3.0.4-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-24122

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate...