CVE-2026-75924: Improper Privilege Management

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...

CVE-2026-66793: Improper Input Validation

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: lazydocker, argo-rollouts, k3s, go, jitsucom-bulker, newrelic-infra-operator, temporal, sftpgo-plugin-auth, octo-sts, continuity, rancher-fleet, timoni, tofu-controller, mattermost, crossplane-provider-azure-storage, azcopy, aws-efs-csi-driver, addon-resizer,...

CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-66660

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

PT-2026-71585

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-19088: Cross-Site Request Forgery (CSRF)

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dodoh4t in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions = 2.5.1...

CVE-2026-17010

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-17010

The Saitama Addon Pack WordPress plugin (versions

EUVD-2026-55026

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-17010

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-17010 Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-17010 Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-17010: Improper Neutralization of Input During Web Page Generation

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-66808

A flaw was found in hypershift-addon-operator. A hub-cluster administrator with write access to the hypershift-operator-install-flags ConfigMap can inject malicious command-line arguments into the privileged install Job. This vulnerability, known as argument injection, allows the attacker to pull...

CVE-2026-0673 Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

MAL-2026-12826 Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

Malicious code in new-native-tools-linux-x64-gnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a The package ships a single 10 MB Rust-compiled Linux x8664 N-API native module tools.linux-x64-gnu.node referenced by main, with a two-line README th...

Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e68f5ef666d2dc9c0582121a44516c5b01abcecda034b830e8d13973e16520 The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at ext.js that is loaded via index.js on require. On...