WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

EUVD-2026-57904

Unauthenticated Cross Site Scripting XSS in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce versions = 2.10.0...

CVE-2026-66692

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66692

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66692

CVE-2026-66692 affects the WordPress Colissimo Officiel: Méthodes de livraison pour WooCommerce plugin (≤ 2.10.0). The issue is an insecure direct object reference (IDOR) in delivery methods. According to the available sources, the vulnerability is rated CVSS 3.1 base score 4.3 (Network, Privileg...

CVE-2026-66692 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-18657

CVE-2026-18657 — Kiro CLI on Windows : An uncontrolled search path element in Kiro CLI before version 2.10.0 may let a remote unauthenticated actor execute arbitrary code by a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local use...

EUVD-2026-52914

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in...

CVE-2026-18657 Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in...

CLEANSTART-2026-ZG52936 Security fixes in apache-nifi 2.10.0-r1

Package apache-nifi version 2.10.0-r1 fixes 31 vulnerabilities: ghsa-x4gw-5cx5-pgmh, ghsa-3qp7-7mw8-wx86, ghsa-f6hv-jmp6-3vwv, ghsa-c2gf-v879-257j, ghsa-cm33-6792-r9fm...

CLEANSTART-2026-NV88421 Security fixes in jitsucom-bulker 2.10.0-r1

Package jitsucom-bulker version 2.10.0-r1 fixes 4 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-fw7p-63qq-7hpr, CVE-2026-26958...

CVE-2026-59531

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks = 2.10.0 versions...

PYSEC-2026-3270 TensorFlow vulnerable to segfault in `SparseBincount`

Impact If SparseBincount is given inputs for indices, values, and denseshape that do not make a valid sparse tensor, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf binaryoutput = True indices = tf.random.uniformshape=, minval=-10000...

PYSEC-2026-3119 TensorFlow vulnerable to segfault in `QuantizedMatMul`

Impact If QuantizedMatMul is given nonscalar input for: - mina - maxa - minb - maxb It gives a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf Toutput = tf.qint32 transposea = False transposeb = False Tactivation = tf.quint8 a = tf.constant7,...

PYSEC-2026-3101 TensorFlow vulnerable to segfault in `QuantizedBiasAdd`

Impact If QuantizedBiasAdd is given mininput, maxinput, minbias, maxbias tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf outtype = tf.qint32 input = tf.constant85,170,255, shape=3, dtype=tf.quint8 bias =...

PYSEC-2026-3233 TensorFlow vulnerable to segfault in `LowerBound` and `UpperBound`

Impact If LowerBound or UpperBound is given an emptysortedinputs input, it results in a nullptr dereference, leading to a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf outtype = tf.int32 sortedinputs = tf.constant, shape=10,0, dtype=tf.float32...

PYSEC-2026-3198 TensorFlow vulnerable to `CHECK` failures in `UnbatchGradOp`

Impact The UnbatchGradOp function takes an argument id that is assumed to be a scalar. A nonscalar id can trigger a CHECK failure and crash the program. python import numpy as np import tensorflow as tf id is not scalar tf.rawops.UnbatchGradoriginalinput= tf.constant1,batchindex=tf.constant0,0,0 ...

PYSEC-2026-3259 TensorFlow vulnerable to Int overflow in `RaggedRangeOp`

Impact The RaggedRangOp function takes an argument limits that is eventually used to construct a TensorShape as an int64. If limits is a very large float, it can overflow when converted to an int64. This triggers an InvalidArgument but also throws an abort signal that crashes the program. python...

PYSEC-2026-3381 TensorFlow vulnerable to Int overflow in `RaggedRangeOp`

Impact The RaggedRangOp function takes an argument limits that is eventually used to construct a TensorShape as an int64. If limits is a very large float, it can overflow when converted to an int64. This triggers an InvalidArgument but also throws an abort signal that crashes the program. python...