CVE-2026-76405: Cleartext Storage of Sensitive Information

In Splunk On-Call VictorOps app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface API key from the App Key Value Store KV Store. The exposure is possible because the Splunk On-Call...

CVE-2026-76253: Improper Privilege Management

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could run arbitrary Search Processing Language SPL commands with the highest level of system privilege and read every credential stored in the credential store, whic...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53454

Prior to version 2.5.2, Blueprint Studio configured Git's credential.helper store, writing usernames and access tokens in plaintext to a .git-credentials file accessible to other users/processes on the same filesystem, exposing Home Assistant Git credentials; the issue is fixed in 2.5.2. No explo...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

EUVD-2026-61485

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

GHSA-59XM-4M8C-G3XJ MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall Summary The app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences e.g., ../ to read, install, or uninstall plugins from...

CVE-2026-73392

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-12965...

Meta Ran Ads for an App That Promised to Nudify Female Politicians

One advertisement featured a pornographic video with a deepfake closely resembling a prominent US politician. Apple removed the app from the App Store after an inquiry from WIRED...

EUVD-2026-60799

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

CVE-2026-73392

...

CVE-2026-73392

CVE-2026-73392 describes an unauthenticated SQL injection in the WordPress plugin Super Store Finder , affecting versions ≤ 7.8 (prior to 7.9). The vulnerability allows an unauthenticated attacker to interfere with database queries, potentially retrieving data they should not access. The issue wa...

CVE-2026-73392

...

CVE-2026-73392

Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...

WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Denver Jackson in WordPress Plugin Super Store Finder versions = 7.8...

PT-2026-77113

Name of the Vulnerable Software and Affected Versions Super Store Finder versions prior to 7.9 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its...

PT-2026-80225

Path Traversal via Unsanitized Identifier in Plugin Install/Uninstall Summary The app-store plugin service concatenates unsanitized user-supplied identifier values directly into file system paths. An attacker can use path traversal sequences e.g., ../ to read, install, or uninstall plugins from...

CVE-2026-53454: Insufficiently Protected Credentials

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

PT-2026-80765

Name of the Vulnerable Software and Affected Versions MineAdmin versions prior to 3.2.0-alpha.2 Description The app-store plugin service fails to sanitize the identifier variable before concatenating it into file system paths. This allows an attacker to use path traversal sequences, such as ../, ...

CVE-2026-75081: Improper Enforcement of Behavioral Workflow

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...