CVE-2026-59674

LPE from suricata user to root due to chown in %post in suricata packaging

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Suse

Products

Opensuse Tumbleweed

CVE-2026-15629

louisho5 picobot Workspace filesystem.go GetSkill link following

A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Louisho5

Products

Picobot

CVE-2026-55885

Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-57770

WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themegoods Wordpress

Products

Grand Photography Wordpress

CVE-2026-15531

yashbhalgat HashNeRF-pytorch Checkpoint File run_nerf.py torch.load deserialization

A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.load of the file run_nerf.py of the component Checkpoint File Handler. The manipulation of the argument ckpt_path leads to deserialization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Yashbhalgat

Products

Hashnerf-pytorch

CVE-2026-15535

AkariAsai self-rag retrieval_lm index.py Indexer.deserialize_from deserialization

A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize_from of the file retrieval_lm/src/index.py of the component retrieval_lm. Executing a manipulation of the argument index_meta.faiss can lead to deserialization. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Akariasai

Products

Self-rag

CVE-2026-57713

WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through <= 7.3.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Marcus (aka @msykes) Wordpress

Products

Events Manager Wordpress

CVE-2026-50135

Hugo: Symlink confinement bypass in resources.Get

Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows symlinks) instead of  Lstat , so a direct  resources.Get  of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored  themes/  theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gohugo

Products

Hugo

CVE-2026-57371

WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through <= 7.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Denishua Wordpress

Products

Wpjam Basic Wordpress

CVE-2026-22098

Sensitive information is written to logs

Various sensitive information such as passwords and charging card UIDs are written to log files.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Evbee

Products

Dc-80

CVE-2026-59518

WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpwax

Products

Wordpress Directorist

CVE-2026-55175

Spinnaker: Improper yaml processing on kustomize bake operations

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Linuxfoundation Spinnaker

Products

Spinnaker Spinnaker

CVE-2026-58281

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Edge Chromium

CVE-2026-57724

WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Themeum Wordpress

Products

Kirki Wordpress

CVE-2026-57738

WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Axiomthemes Wordpress

Products

777 Wordpress

CVE-2026-57744

WordPress RT-Theme 18 | Extensions plugin <= 2.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Stmcan Wordpress

Products

Rt-theme 18 | Extensions Wordpress

CVE-2026-58253

NATS Server: Route API Auth Bypass

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Linuxfoundation Nats

Products

Nats-server Nats Server

CVE-2026-58252

NATS Server: Subscribe Authz Bypass via Wildcard-Overlap

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset of it, and queue subscriptions could also affect delivery to legitimate queue consumers. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linuxfoundation Nats

Products

Nats-server Nats Server

CVE-2026-58251

NATS Server: Queue Subscribe Authz Bypass

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user with subscription deny permissions could bypass a plain subject deny rule by using a queue subscription, because queue-specific deny evaluation could override the plain subject deny result when the queue name itself was not denied. This issue is fixed in versions 2.14.0, 2.12.7, and 2.11.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linuxfoundation Nats

Products

Nats-server Nats Server

CVE-2026-48588

Potential exposure of private data via cached Set-Cookie response

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMiddleware` and the `cache_page()` decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Chris Whyland for reporting this issue.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Djangoproject

Products

Django