Search: 17.9-6

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1.

Red Hat OpenShift Container Platform 4.22.17 includes a security update addressing multiple bugs and vulnerabilities. This update is rated as having an Important security impact by Red Hat Product Security. The advisory provides updated container images and references RPM package updates in a related advisory. Users are advised to upgrade to the fixed versions to apply the security fixes and enhancements.

CVE-2026-49878 is a high-severity remote code execution vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. The flaw exists in the wpas_handle_robust_av_scs_recv_action function of robust_av.c, where a logic error can cause an out-of-bounds write. Exploitation does not require user interaction but does require system-level execution privileges.

CVE-2026-58859 is a high severity denial of service vulnerability in Google Android version 17. It arises from uncaught exceptions in multiple locations, potentially allowing local privilege escalation without requiring user interaction.

CVE-2026-55269 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It arises from improper input validation in the FilterCapturedPacket function of snoop_logger.cc, leading to a possible memory safety issue. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-49937 is a high-severity vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves an out-of-bounds read in multiple functions of MessageQueueBase.h due to incorrect bounds checking. Exploitation does not require user interaction and could lead to local privilege escalation without additional execution privileges.

CVE-2026-49933 is a high-severity vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It involves a possible control-flow hijack in the privileged Bluetooth process due to an uninitialized pointer dereference in the handle_le_monitor_device_event function. Exploitation does not require user interaction and could lead to local privilege escalation with full confidentiality, integrity, and availability impact.

CVE-2026-49885 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It arises from an integer overflow in the rw_t4t_update_file function of rw_t4t.cc, leading to a possible out-of-bounds write. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-49880 is a high severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It arises from a missing bounds check in multiple functions within the nfa_nfcee_act.cc component, leading to a possible out-of-bounds write. Exploitation does not require user interaction or additional execution privileges.

Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9.

CVE-2026-97071 is an incorrect calculation vulnerability in the VillaTheme CURCY woo-multi-currency plugin that allows integer attacks. It affects versions from the initial release up to 2.2.17. The vulnerability has a medium severity rating with a CVSS score of 5.3. There is no indication of known exploits in the wild or an official patch available at this time.

ZITADEL versions 4.x prior to 4.17.1 do not verify whether an organization is inactive during Login V2 authentication, only checking the individual user's status. This allows users belonging to deactivated organizations who have valid credentials, existing sessions, or refresh tokens to continue signing in, creating sessions, and obtaining or refreshing tokens.

ZITADEL versions 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 have a vulnerability where links between user accounts and external identity providers are created without verifying a primary authentication factor or the caller's permission. This allows an unauthenticated attacker who knows a victim's login name to link their own external identity provider identity to the victim's account and subsequently sign in as that victim.

ZITADEL versions 3.x before 3.4.15 and 4.x before 4.17.1 contain an improper authorization vulnerability. The flaw occurs when issuing passkey or passwordless enrollment codes, where the system verifies only the organization in the x-zitadel-orgid header instead of the target user's organization. This allows attackers with user-write permission in one organization to obtain enrollment codes for users in other organizations on the same instance and register their own authenticators, effectively taking over those accounts.

ZITADEL versions 4.x before 4.17.3 and 3.x through 3.4.15 use unauthenticated, malleable encryption to protect IdP intent tokens. This flaw allows authenticated users to tamper with their own tokens to impersonate another user's external login intent. An attacker who can predict a victim's in-flight intent identifier and win a timing race may steal the victim's IdP tokens or hijack their session.