WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin HashBar – WordPress Notification Bar versions = 2.0.3...

EUVD-2026-83940

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074

CVE-2026-55074 affects the Ansible FreeBSD Jail Connection Plugin (jailexec) through version 1.3.0 . The put_file function resolved transfer destinations to paths on the jail host and executed mkdir -p and mv as root on the host , rather than inside the jail. Because these commands follow symboli...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

PT-2026-96059

Name of the Vulnerable Software and Affected Versions To Do List Member WordPress plugin versions prior to 1.7 Description An import routine lacks authorization and nonce checks, and fails to validate the source location of fetched data. This allows unauthenticated users to create arbitrary...

PT-2026-96215

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description An issue exists where PluginSettingList, PluginAllSettingList, and PluginSettingDetail use GlobalSettingsPermissions without the IsAuthenticated permission. Because GlobalSettingsPermissions allows...

PT-2026-96057

Name of the Vulnerable Software and Affected Versions RestroPress WordPress plugin versions prior to 3.4.6 Description Insufficient server-side validation of client-supplied item add-on prices occurs when items are added to or updated in the cart. This allows unauthenticated users to manipulate t...

PT-2026-96058

Name of the Vulnerable Software and Affected Versions GiveWP WordPress plugin versions prior to 4.16.9 Description Unauthenticated users can execute arbitrary shortcodes registered on the site because the plugin fails to properly remove shortcode delimiters from donor-supplied values before...

CVE-2026-61744: Authorization Bypass Through User-Controlled Key

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-55074: Improper Link Resolution Before File Access

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

SUSE CVE-2026-15815

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

OESA-2026-3994 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

OESA-2026-3992 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

OESA-2026-3993 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

WordPress Kirki plugin 6.0.0-6.3.0 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.0.0-6.3.0...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Plugin Image Settings Update vulnerability

Authenticated Plugin Image Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin NextGEN Gallery versions 4.5.0...

CVE-2026-84223: Improper Neutralization of Input During Web Page Generation

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens...