WordPress WebTotem Backups plugin <= 1.0.1 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by João Ramos Maciel in WordPress Plugin WebTotem Backups versions = 1.0.1...

WordPress DS Ad Rotator plugin <= 0.8 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin DS Ad Rotator versions = 0.8...

WordPress CryptoPayment Gateway plugin 1.2.1-1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update vulnerability

Unauthenticated Arbitrary File Deletion and Settings Update vulnerability discovered by Pedro Pinho in WordPress Plugin CryptoPayment Gateway versions 1.2.1-1.2.2...

WordPress Yogeta WP Cloud plugin <= 1.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by Huynh Kien Minh in WordPress Plugin Yogeta WP Cloud versions = 1.0...

WordPress User Registration & Membership plugin 4.4.6-5.2.7 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin User Registration versions 4.4.6-5.2.7...

WordPress WP images upload on piclect plugin <= 1.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by João Ramos Maciel in WordPress Plugin WP images upload on piclect versions = 1.0...

WordPress WP Component plugin <= 2.2.4 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin WP Component versions = 2.2.4...

WordPress Add User Autocomplete plugin < 1.2 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Nguyen Huu Do in WordPress Plugin Add User Autocomplete versions 1.2...

WordPress MemberPress Corporate Accounts plugin <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by andrea bocchetti in WordPress Plugin MemberPress Corporate Accounts versions = 1.5.39...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: gcc13: gcc13-13.5.0-0.1.hum1 aarch64, x8664 gcc13-c++-13.5.0-0.1.hum1 aarch64, x8664 gcc13-gfortran-13.5.0-0.1.hum1 aarch64, x8664 gcc13-plugin-annobin-13.5.0-0.1.hum1 aarch64, x8664...

CVE-2026-85195

Articles Anywhere is a Joomla extension published by regularlabs.com . In versions

PT-2026-91402

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numer...

CVE-2026-44162: Improper Handling of Highly Compressed Data (Data Amplification)

fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the ins3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompressionsizelimit. An attacker with permission to upload objects to the...

PT-2026-91238

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

PT-2026-91140

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

PT-2026-91859

Name of the Vulnerable Software and Affected Versions 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery versions prior to 1.16.21 Description Unauthenticated attackers can extract sensitive data from password-protected flipbooks by exploiting the id parameter. This allows th...

PT-2026-91214

LangBot's plugin runtime pip package langbot plugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugin debug key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

PT-2026-91164

Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilder article id from the request and concatenated it directly into the WHERE view ...

PT-2026-91411

Name of the Vulnerable Software and Affected Versions Really Simple Security plugin for WordPress versions prior to 9.8.2 Description An authorization check is missing in the profile-page update handler, allowing authenticated low-privileged attackers to bypass enforced two-factor authentication...

CVE-2026-10556: Improper Check for Unusual or Exceptional Conditions

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...