CVE-2026-118188

PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-118639

Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure

The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Surfer

CVE-2026-110813

Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-88800

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-101393

Unauthenticated Cross‑Site Request Forgery in Oracle Siebel Apps - Marketing

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Siebel Apps - Marketing Siebel Crm

CVE-2026-54876

Client-Side Memory Leak in OCSP Response Checking

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Openssl

Products

Openssl

CVE-2026-97027

Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service (e.g. forced application restart loops) or to influence host D-Bus/systemd activation behavior beyond what the sandbox is intended to permit.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-97026

Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation failures (denial of service); tampered content would fail signature/digest verification rather than being trusted.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-97025

Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources (e.g. as used by Fedora) are affected; libostree-based sources such as Flathub are not.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-96546

Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Gimp Redhat

Products

Gimp Enterprise Linux Rhel Els

CVE-2026-96284

Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-96283

Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-96282

Flatpak: flatpak: extension metadata path traversal file existence oracle

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-116767

Improper input handling in Secure Access servers

CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absolute

Products

Secure Access

CVE-2026-93009

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-93010

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-91142

Cockpit: cockpit: unauthorized modification of login records via integer overflow

A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Dev Spaces Openshift Devspaces and 1 more

CVE-2026-90463

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2026-65941

WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Whatsup Gold Whatsup Gold

CVE-2026-87876

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Openprinting Redhat

Products

Cups Enterprise Linux Hardened Images and 4 more