CVE-2026-6898

The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'WishListMember3Hooks::generateapikey' function in all versions up to, and including, 3.30.1. This makes it possible for authenticated attackers, with...

Exploit for CVE-2026-23813

CVE-2026-23813 — AOS-CX Pre-Auth Authentication Bypass Unau...

PT-2026-42886

Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 0.12.2 Description An issue in the Midjourney Image Relay Endpoint component, specifically within the RelayMidjourneyImage/GetByOnlyMJId function located in the router/relay-router.go file, allows for a...

PT-2026-42885

Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 0.12.2 Description A SQL injection flaw exists in the 'self' Endpoint within the model/topup.go file. The issue is located in the SearchUserTopUps and SearchAllTopUps functions, allowing a remote attacker ...

PT-2026-42865

Name of the Vulnerable Software and Affected Versions Wishlist Member versions prior to 3.30.2 Description The Wishlist Member plugin for WordPress allows unauthorized modification of data because the save settings function in WishListMemberFeaturesTeam Accounts lacks a capability check...

WordPress plugin Wishlist Member 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

cal.diy 代码问题漏洞

cal.diy is an open-source calendar scheduling platform developed by Cal. Versions of cal.diy 4.9.4 and earlier have code vulnerabilities. These vulnerabilities stem from the Logo API component file apps/web/app/api/logo/route.ts, specifically the function validateUrlForSSRF, which may lead to...

New API SQL注入漏洞

The New API is an interface software developed by QuantumNous. Versions of the New API prior to 0.12.1 have a SQL injection vulnerability. This vulnerability originates from the SearchUserTopUps/SearchAllTopUps function in the model/topup.go file of the self Endpoint component, which may lead to...

PT-2026-42864

Name of the Vulnerable Software and Affected Versions WishList Member versions prior to 3.30.2 Description Missing authorization in the export settings function allows for sensitive information disclosure and privilege escalation. The function fails to perform capability checks, enabling an...

Malicious code in chai-as-repaired (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949b90bd3c157955d029f9ea08bc32aea893e452c4ded78df98b80c1b831be76 Package name 'chai-as-repaired' is a 1-edit typosquat of the popular 'chai-as-promised' chai plugin 1M weekly downloads. The published code is...

USN-8279-2: Linux kernel (GCP) vulnerabilities

It was discovered that the Linux kernel algifaead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-31431 Several security issues were discovered in th...

USN-8279-2 linux-gcp-5.15 vulnerabilities

It was discovered that the Linux kernel algifaead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-31431 Several security issues were discovered in th...

CVE-2026-4843

The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the processajaxrestoreaction function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: buildkitd, kubescape-operator, gogatekeeper, headlamp, k8ssandra-client, zarf, xeol, kaniko, spegel, grype, scorecard, envoy-gateway, k9s, consul-k8s, helm-set-status, kubescape, neuvector-scanner, syft, kots, rancher-helm, docker-cli-buildx, docker-compose, rancher,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: buildkitd, kubescape-operator, gogatekeeper, headlamp, k8ssandra-client, zarf, xeol, kaniko, spegel, grype, scorecard, envoy-gateway, k9s, consul-k8s, helm-set-status, kubescape, neuvector-scanner, syft, kots, rancher-helm, docker-cli-buildx, docker-compose, rancher,...

EUVD-2026-31491

The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports and executes arbitrary Python files from model directories via the modelfile configuration field in config.json. When a model's config.json specifies a modelfile pointing to a Python...

USN-8280-2: Linux kernel (Azure)vulnerabilities

It was discovered that the Linux kernel algifaead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-31431 Several security issues were discovered in th...

EUVD-2026-31493

The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trustremotecode=True when loading model tokenizers, and runs without sandboxing. This causes transformers.AutoTokenizer.frompretrained to import and execute arbitrary Python files included in any model pulled fr...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: helm-operator, opa-fips, gatekeeper, buildkitd, headlamp-fips, datadog-agent, kgateway, containerd, envoy-gateway-fips, chartmuseum, kube-arangodb, opa-envoy, jfrog-cli, opa, gogatekeeper, neuvector-scanner, helm-set-status, upwind-agent, newrelic-infrastructure-agen...

CVE-2026-40172

authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/pk/ API allows a caller with changeuser on a target user to assign arbitrary groups through UserSerializer, including groups with issuperuser=True, without...