CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

CLSA-2026-1784596324 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 8.18.0-tuxcare.1...

CLSA-2025-1765930332 TuxCare security update for mysql-connector-python (4 CVEs)

TuxCare rebuilt mysql-connector-python to address 4 CVEs. Fixed in 8.4.0.post1+tuxcare...

Critical: php8.4

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Attacker-provided inputs to bccomp could lea...

Critical: php

Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Circular symbolic links in phar archives cou...

CVE-2026-18604

Summary (CVE-2026-18604): A vulnerability in the Android app textPlus Text Message and Call App (up to 8.3.5) affects DialerActivity within the com.gogii.textplus component. The issue is described as an improper export of Android application components, enabling a local attacker to manipulate the...

php:8.2 security, bug fix, and enhancement update

libzip php 8.2.32-1 - rebase to 8.2.32 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip...

Fedora 44 : php (2026-6131a972fe)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6131a972fe advisory. PHP version 8.5.9 30 Jul 2026 Core: Fixed bug GH-22290 AST pretty printing does not correctly handle strings containing NUL. iliaal Fixed bug GH-222...

CVE-2026-11536

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector...

CVE-2026-11536 IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector...

CVE-2026-11536

CVE-2026-11536 affects IBM WebSphere Application Server versions including 8.5 and 9.0 (SOAP/JMX connector). Connected documents confirm an RCE vulnerability via the SOAP/JMX/HTTP interface with CWE-502 (Deserialization of Untrusted Data) and IBM CVSS data (up to 8.8 base score in some bulletins;...

CLEANSTART-2026-IY97234 Security fixes in openjdk8 8.191.12-r0

Package openjdk8 version 8.191.12-r0 fixes 9 vulnerabilities: CVE-2018-3136, CVE-2018-3139, CVE-2018-3149, CVE-2018-3169, CVE-2018-3180...

CLEANSTART-2026-BJ59269 Security fixes in elastic-beats 8.18.1-r0

Package elastic-beats version 8.18.1-r0 fixes 4 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-4vq8-7jfc-9cvp, CVE-2025-54410, CVE-2026-33186...

CLEANSTART-2026-AU09596 Security fixes in confluent-kafka 8.2.0-r0

Package confluent-kafka version 8.2.0-r0 fixes 7 vulnerabilities: CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-2332...

CLEANSTART-2026-ZW95372 Security fixes in kubernetes-csi-external-snapshotter-fips 8.5.0-r2

Package kubernetes-csi-external-snapshotter-fips version 8.5.0-r2 fixes 8 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-27140, CVE-2026-32283...

CLEANSTART-2026-TH89970 Security fixes in openjdk8 8.242.08-r0

Package openjdk8 version 8.242.08-r0 fixes 7 vulnerabilities: CVE-2020-2583, CVE-2020-2590, CVE-2020-2593, CVE-2020-2601, CVE-2020-2604...

DEBIAN-CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-58186

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58183 Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the iss...

CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...