WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by VDsec in WordPress Plugin miniorange otp verification versions = 5.5.1...

Security Bulletin: Vulnerability in Java affects IBM Netezza Appliance

Summary The Java package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-34282 Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to...

WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dodoh4t in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions = 2.5.1...

MINI-C493-XF58-95Q8

Bulletin has no description...

MINI-RWC4-JWHQ-72W8

Bulletin has no description...

CVE-2025-30241

creationtimestamp| type| source ---|---|--- 2026-08-11 00:25:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/it4zyfhddhbus 2026-10-15 08:49:40+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3mxvokgn4fz26...

PT-2026-70076

Name of the Vulnerable Software and Affected Versions Samsung Open Source rlottie affected versions not specified Description Improper validation of the specified quantity in input allows for input data manipulation. Recommendations At the moment, there is no information about a newer version tha...

PT-2026-70539

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A use after free issue in Windows DNS allows an authorized attacker to execute arbitrary code over a network, which can affect the system. Use after free is a memory corruption flaw that...

CVE-2026-64934: Reliance on Untrusted Inputs in a Security Decision

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

CVE-2026-71290: Improper Certificate Validation

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

PT-2026-70833

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

PT-2026-70077

Name of the Vulnerable Software and Affected Versions ManageEngine M365 Manager Plus versions prior to 4820 ManageEngine M365 Security Plus versions prior to 4820 Description An authenticated path traversal issue exists within the Exchange Online backup module. Path traversal is a flaw that allow...

PT-2026-70142

Name of the Vulnerable Software and Affected Versions Apioo Fusio version 8.8.3 Description An authenticated user with the consumer role can trigger server-side request forgery by registering a webhook URL that points to an internal host. The webhook registration endpoint validates URL syntax usi...

PT-2026-70942

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.2 Description A heap-based buffer overflow exists in the Diameter S6a Interface component within the mme s6a subscription data from avp function of the src/mme/mme-fd-path.c file. This issue can be triggered...

Windows Package Manager (WinGet) < 1.29.280 Elevation of Privilege (CVE-2026-68821)

The version of Windows Package Manager WinGet installed on the remote host is prior to 1.29.280. It is, therefore, affected by an elevation of privilege vulnerability: - An elevation of privilege vulnerability exists in Windows Package Manager that allows a local attacker with low privileges to...

PT-2026-70845

A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss ogs diam s6a air cb/hss ogs diam s6a ulr cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is...

PT-2026-70897

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.30.0 Description Server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLS TYPE CAPABILITIES PDU while the rdstls server authenticate function is waiting for RDSTLS TYPE AUTHREQ. This leaves...

PT-2026-70925

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

Fedora 44 : kernel (2026-d232156d86)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d232156d86 advisory. The 7.1.8 stable kernel updates contain a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream wi...