CVE-2026-98356

A flaw was found in the Linux kernel's Broadcom NetXtreme bnxtre driver. During device initialization, the driver fails to verify that memory allocation for the Data Center Bridging DCB workqueue succeeded. Under low-memory conditions where this setup fails, a subsequent asynchronous DCB...

EUVD-2026-94213

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

kernel: ipv6: fix use-after-free in ip6_finish_output2()

A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6finishoutput2 function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive...

CVE-2026-96530

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-97188

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-86816

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-104667

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...

LocalExifGeoMap

Local Exif Geo Map 📍 أداة قوية تركز على الخصوصية، تعمل في المتصفح، لتحليل وعرض بيانات GPS من صورك. ببساطة قم بسحب وإسقاط الصور لإنشاء خرائط تفاعلية، خرائط حرارية، ملفات ارتفاع، وإحصائيات الرحلات. لماذا؟ لطالما أردت أداة مُستضافَة ذاتيًا لتحليل صوري وتحويلها إلى خرائط. ثم جاءت عطلتي الكرواتية، حيث...

Juniper-exploit-CVE-2023-36845

CVE-2023-36845 विवरण CVE-2023-36845 एक महत्वपूर्ण PHP पर्यावरण चर हेरफेर भेद्यता है जो Juniper SRX फायरवॉल और EX स्विच को प्रभावित करती है। जबकि Juniper ने इस भेद्यता को मध्यम गंभीरता की श्रेणी में रखा है, इस लेख में हम यह समझाएँगे कि इस एकल भेद्यता का उपयोग दूरस्थ, अप्रमाणित कोड निष्पादन के लिए...

CVE-2025-62950-PoC

الوصف يصف إثبات المفهوم هذا PoC ثغرة تزوير الطلبات عبر المواقع CSRF الموجودة في إضافة Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. تسمح هذه المشكلة للمهاجم بخداع مستخدم مُصادَق لتنفيذ طلب مُصمَّم يحذف عنصر معرض دون موافقته وعن غير قصد، مما يؤدي إلى فقدان محتوى بشكل غير...

React2Shell_cve-2025-55182

React Server Components RCE - CVE-2025-55182 Bonjour ! J'espère que vous passez une excellente journée ! 😊✨ De quoi s'agit-il ? Les versions 19.0.0 , 19.1.0 , 19.1.1 et 19.2.0 de React Server Components présentent un grave problème de sécurité. Les paquets react-server-dom-parcel,...

CVE-2026-96530 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

EUVD-2026-94190

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

WordPress WPCafe plugin < 3.0.21 - Unauthenticated Product Data Disclosure vulnerability

Unauthenticated Product Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WPCafe versions 3.0.21...

CVE-2026-96530 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

CVE-2026-86816 WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

CVE-2026-96530

The Optimole WordPress plugin versions prior to 4.2.15 is vulnerable to a sensitive data disclosure. The root cause is a missing capability check before exposing stored image-optimization account data within a dashboard widget. This flaw allows any authenticated user , including those with the lo...