CVE-2026-32479 is a critical unauthenticated SQL Injection vulnerability in Visitor Traffic Real Time Statistics Pro versions up to and including 11.17. This flaw allows an attacker to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently available from the vendor.
The 12 Step Meeting List WordPress plugin before version 3.19.17 contains a stored Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape input submitted by unauthenticated users before storing it in its activity log and displaying it in the admin area. This vulnerability could allow attackers to execute malicious scripts in the context of high privilege users such as administrators.
The coturn-4.17.2-1.1 package on openSUSE Tumbleweed addresses multiple security issues. These vulnerabilities have been fixed in this package version. No specific details about the individual vulnerabilities or affected versions are provided.
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
Red Hat Advanced Cluster Management for Kubernetes versions 2.17.0 up to but not including 2.17.1 contain multiple security vulnerabilities rated with high severity by Red Hat Product Security. These vulnerabilities are addressed in the 2.17.1 update, which includes security fixes, bug fixes, and updated container images. Users should apply the 2.17.1 update after ensuring all relevant previous errata are applied.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
Kiali 2.17.13, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2026-45623 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15108)
* CVE-2026-45623 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15113)
* CVE-2026-54272 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15120)
* CVE-2026-54272 openshift-service-mesh/kiali-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15121)
* CVE-2026-69153 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15158)
* CVE-2026-69153 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15163)
* CVE-2026-69152 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15173)
* CVE-2026-69152 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15174)
* CVE-2026-69192 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15184)
* CVE-2026-69192 openshift-service-mesh/kiali-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15185)
* CVE-2026-14257 openshift-service-mesh/kiali-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15197)
* CVE-2026-14257 openshift-service-mesh/kiali-ossmc-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15226)
* CVE-2026-45149 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges (OSSM-15260)
* CVE-2026-45149 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges (OSSM-15262)
* CVE-2026-73088 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15291)
* CVE-2026-73088 openshift-service-mesh/kiali-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15292)
* CVE-2026-73089 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15310)
* CVE-2026-73089 openshift-service-mesh/kiali-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15311)
* CVE-2026-67313 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15478)
* CVE-2026-67313 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15479)
* CVE-2026-67320 openshift-service-mesh/kiali-ossmc-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15488)
* CVE-2026-67320 openshift-service-mesh/kiali-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15489)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The Newsletters plugin for WordPress up to version 4.17 contains an authorization bypass vulnerability. Authenticated users with author-level access or higher can exploit this flaw to send arbitrary newsletter emails to users of any role, including administrators. This is achieved by manipulating POST fields to specify unauthorized recipient roles, enabling mass mailing and potential phishing attacks via the site's email system.
CVE-2026-19851 is a Use of Default Password vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.5-1. This flaw could allow an attacker to gain unauthorized access to user accounts created during XML import. The vulnerability has a high severity with a CVSS score of 7.7, indicating significant confidentiality and integrity impact with low availability impact. No official patch or remediation guidance has been provided yet.
InfusedWoo Pro plugin for WordPress versions up to and including 5.1.17 contains a missing authorization vulnerability in the ajax_iwar_preview_email() function. This flaw allows authenticated users with subscriber-level privileges or higher to generate and retrieve password reset links for any WordPress user, including administrators, enabling account takeover.
A vulnerability exists in the IronVNC client within Devolutions Remote Desktop Manager versions 2026.2.17.0 and earlier, and 2026.1.24.0 and earlier. The issue is due to insufficient verification of data authenticity, allowing an on-path attacker to intercept and tamper with VNC sessions by exploiting automatic acceptance of the server's RSA key during RSA-AES authentication. This flaw could lead to integrity compromise of the session data without user privileges or system availability impact.
Apache Camel contains an improper input validation vulnerability in its camel-mail component's MimeMultipart data format when configured with headersInline set to true. This flaw allows untrusted MIME headers to be copied as Camel message headers without filtering, potentially enabling an attacker to inject headers in the Camel-internal namespace. Such injected headers can alter the behavior of downstream route steps, depending on the route configuration. The issue affects versions from 2.17.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. The vulnerability is fixed in Apache Camel 4.22.0, 4.14.9, and 4.18.4. Users unable to upgrade immediately should keep headersInline disabled or strip Camel-internal headers after unmarshalling.
A 17-year-old security researcher discovered 55 critical vulnerabilities in the Punjab School Education Board (PSEB) portal, affecting over 10 million students. The vulnerabilities include 9 critical flaws that could allow server takeover and 45 high severity issues. Sensitive student data such as names, addresses, phone numbers, exam results, certificates, and parent information are at risk. The researcher reported the issues to PSEB and CERT-In in late July 2026, but as of 25 days later, no response or patch has been issued. This lack of government action has prompted public disclosure to raise awareness and urge immediate remediation.
CVE-2026-59295 is a medium severity vulnerability in Spring Micrometer where outbound HTTP requests using a Micrometer-instrumented client can cause a denial-of-service condition due to an unbounded memory leak. This issue affects multiple versions of Micrometer including 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and all versions up to 1.9.18. The vulnerability is classified under CWE-401, indicating missing release of memory after its effective lifetime. No patch or remediation details are provided in the available data.
A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.