EUVD-2026-60777

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CLEANSTART-2026-ZV01642 Security fixes in prometheus 3.5.1-r0

Package prometheus version 3.5.1-r0 fixes 1 vulnerabilities: CVE-2026-24051...

CVE-2026-15759

The ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escapin...

CVE-2026-15759

Summary: CVE-2026-15759 affects the WordPress plugin “ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form.” The vulnerability is a Stored Cross-Site Scripting (XSS) via the 'number' and 'group' Shortcode Attributes in all versions up to and including 3.5.1 due to insuf...

CVE-2026-57387

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in picu picu picu allows Stored XSS.This issue affects picu: from n/a through = 3.5.1...

CVE-2026-57387 WordPress picu plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in picu picu picu allows Stored XSS.This issue affects picu: from n/a through = 3.5.1...

CVE-2026-57387

CVE-2026-57387 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin picu (versions up to and including 3.5.1). The issue arises from improper neutralization of input during web page generation, enabling an attacker to inject malicious scripts that are stored and later rend...

CVE-2026-9560

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel...

CVE-2026-9560

Summary: CVE-2026-9560 affects OpenVPN Connect for macOS (versions 3.5.1–3.8.1). Affected component is the background service that can escalate privileges via a local IPC channel, allowing an attacker to execute arbitrary commands with elevated privileges. The CVSS metrics indicate a high-impact,...

PT-2026-43371

Name of the Vulnerable Software and Affected Versions OpenVPN Connect versions 3.5.1 through 3.8.1 Description A privilege escalation issue exists in the background service of OpenVPN Connect on macOS. This allows attackers to execute arbitrary commands with elevated privileges by utilizing a loc...

CLEANSTART-2026-OR40192 Security fixes for CVE-2026-24051, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-39882, CVE-2026-39883, CVE-2026-42499 applied in versions: 3.5.1-r0, 3.5.1-r1, 3.5.3-r0

Multiple security vulnerabilities affect the prometheus package. These issues are resolved in later releases. See references for individual vulnerability details...

Astra Linux – Vulnerability in libarchive

In libarchive versions 3.4.1 through 3.5.1, there is a use-after-free in the copystring function called from douncompressblock and processblock...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Clients based on FreeRDP prior to version 3.5.1 are vulnerable to a possible NULL access and may crash. Version 3.5.1 contains a patch for this issue. There are no known workarounds available...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Clients that use FreeRDP before version 3.5.1 are vulnerable to out-of-bounds read vulnerabilities. Version 3.5.1 includes a patch for this issue. There are no known workarounds available...

Astra Linux – Vulnerability in freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Clients that rely on FreeRDP before version 3.5.1 are vulnerable to out-of-bounds read attacks if nWidth == 0 and nHeight == 0. Version 3.5.1 includes a patch for this issue. There are no known workarounds available...

NPM: claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh

NPM: claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh vulnerability discovered by ? in WordPress Npm claude-code-cache-fix versions = 3.5.0, 3.5.2...

claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh

Summary tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of the payload closes the literal early and lets following bytes execute as Python in the user...

WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.1 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin WPIDE – File Manager & Code Editor versions = 3.5.1...

WordPress Emailchef plugin <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Settings Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Settings Deletion vulnerability discovered by Legion Hunter in WordPress Plugin Emailchef versions = 3.5.1...

PT-2026-34317

The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the page options ajax disconnect function in all versions up to, and including, 3.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and...