PT-2026-63591

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

PT-2026-64173

Name of the Vulnerable Software and Affected Versions xiandafu beetl version 3.20.2 Description A remote attacker can execute arbitrary code by leveraging the type.new function and the property reflection mechanism. Property reflection is a process that allows a program to inspect and modify its...

CVE-2026-52439

An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism...

PT-2026-63531

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploi...

No Snake Oil: Verifying Python Package Builds

Python has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index PyPI. This creates a need to analyse supply chains comprising such packages. One such analysis is to rebuild packages in order to identify compromised...

CVE-2026-15011: Improper Control of Generation of Code

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-52439

An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism...

PT-2026-63996

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

PT-2026-63580

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

The vulnerability of the jv_object_merge_recursive() function in the jq JSON processing tool allows a attacker to cause a service failure.

The vulnerability of the jvobjectmergerecursive function in the jq JSON processing tool is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the ath12k_qmi_driver_event_work() function in the drivers/net/wireless/ath/ath12k/qmi.c file of the Atheros/Qualcomm wireless adapter driver module in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ath12kqmidrivereventwork function in the drivers/net/wireless/ath/ath12k/qmi.c file of the Atheros/Qualcomm wireless communication adapter driver in the Linux operating system is related to improper memory release memory leak. Exploiting this vulnerability could allow an...

The vulnerability of the rsi_coex_attach() function in the drivers/net/wireless/rsi/rsi_91x_coex.c driver for wireless communication adapters in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the rsicoexattach function in the drivers/net/wireless/rsi/rsi91xcoex.c file of the wireless adapter driver for the Linux operating system is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the ssi_probe() function in the drivers/hsi/controllers/omap_ssi_core.c file of the HSI high-speed synchronous serial interface driver in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ssiprobe function in the drivers/hsi/controllers/omapssicore.c file of the Linux high-speed synchronous serial interface driver core is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-38766

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub186f4 function...

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

CVE-2026-13065 MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

CVE-2026-13065 MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

Exploit for Improper Authentication in Microsoft

CVE-2023-21817 - Windows Kerberos LPE Vulnerability Checker A...

CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...