EUVD-2026-53299

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

CVE-2026-0931

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart...

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin < 5.0.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions 5.0.0...

EUVD-2026-53296

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart...

CVE-2026-0931 Denial-of-service vulnerability in M-Files Server

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart...

WordPress Material Dashboard plugin <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability

Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Material Dashboard versions = 1.4.10...

CVE-2026-15452

The CVE covers the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. Affected software: WordPress plugin versions up to 6.11.3. Vulnerability: Reflected Cross-Site Scripting via REQUEST_URI Query String caused by insufficient input sanitization and output escaping. Impact:...

OPENSUSE-SU-2026:21534-1 Security update for wireshark

This update for wireshark fixes the following issues: Update to version 4.4.17. - CVE-2026-6867: SMB2 protocol dissector crash bsc1263727. - CVE-2026-7375: UDS protocol dissector infinite loop bsc1263761. - CVE-2026-7376: Sharkd utility crash bsc1263760. - CVE-2026-7378: Sharkd utility crash...

CLSA-2026-1785921265 TuxCare security update for org.springframework (1 CVE)

TuxCare rebuilt 21 org.springframework packages to address 1 CVE. Fixed in 4.3.30.RELEASE-tuxcare.4...

OPENSUSE-SU-2026:21533-1 Security update for dnsdist

This update for dnsdist fixes the following issues: Update to 1.9.15. Changes for dnsdist: - https://www.dnsdist.org/changelog.htmlchange-1.9.15 - https://www.dnsdist.org/changelog.htmlchange-1.9.14 Security issues fixed: - CVE-2026-40011: invalid output produced in the prometheus endpoint when a...

CLSA-2026-1785921094 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.7...

WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

CVE-2026-69248 vulnerabilities

Vulnerabilities for packages: openstack-glance-2026.1, openstack-glance-2025.2, apache-beam-python-3.13-sdk, openstack-nova-2026.1, openstack-nova-2025.1, openstack-nova-2025.2, openstack-glance-2025.1, apache-beam-python-3.12-sdk, apache-beam-python-3.11-sdk...

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

CVE-2026-71208

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-6972

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-11969

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs' Parameter in all versions up to, and including, 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2026-11920

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...