CVE-2025-39964 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-azure, linux-desktop, linux-firecracker, linux-qemu, linux-aws, linux-gcp, linux-qemu-melange, linux-raspberry-pi, linux-raspberry-pi-4...

CVE-2025-39682 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-azure, linux-desktop, linux-firecracker, linux-qemu, linux-aws, linux-gcp, linux-raspberry-pi, linux-raspberry-pi-4...

CVE-2026-82399 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache-fips...

CVE-2026-86003 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache-fips...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: opentofu, grafana-pyroscope-fips, grafana-pyroscope, terraform-fips...

CVE-2026-85721 vulnerabilities

Vulnerabilities for packages: apache-pulsar-fips...

CVE-2026-85717 vulnerabilities

Vulnerabilities for packages: apache-pulsar-fips...

CVE-2026-86000 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-85999 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-85732 vulnerabilities

Vulnerabilities for packages: xeol...

CVE-2026-76845 vulnerabilities

Vulnerabilities for packages: renovate...

CVE-2026-81871 vulnerabilities

Vulnerabilities for packages: opentofu...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: containerd, argocd-image-updater, openbao, cloudflared, jitsucom-bulker, gatekeeper, vitess, tekton-pipelines, gogatekeeper, kserve-modelmesh-serving, dagdotdev, trillian, vcluster, kube-state-metrics, src, istio, skaffold, dgraph, kubernetes-csi-external-snapshotter...

CVE-2026-92807 Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

CVE-2026-92807 Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-92967 Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...

CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-92967 Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...

CVE-2026-89081 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...