CLSA-2026-1792372482 TuxCare security update for @storybook/addon-actions (1 CVE)

TuxCare rebuilt @storybook/addon-actions to address 1 CVE. Fixed in 8.5.8-tuxcare.1...

CLSA-2026-1792372481 TuxCare security update for @storybook/addon-actions (1 CVE)

TuxCare rebuilt @storybook/addon-actions to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been...

CVE-2026-104246

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-104246

The Contact Form 7 Signature Addon WordPress plugin (versions through 4.2.2 ) is vulnerable to an unauthenticated arbitrary file read via path traversal . The root cause is the lack of sanitization for a signature field value when building an email attachment path. An attacker can attach arbitrar...

CVE-2026-104246 Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

EUVD-2026-103250

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-104246 Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

PT-2026-116368

Name of the Vulnerable Software and Affected Versions Contact Form 7 Signature Addon versions prior to 4.2.3 Description An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a...

CVE-2026-104246: Improper Limitation of a Pathname to a Restricted Directory

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CLSA-2026-1792160913 TuxCare security update for @storybook/addon-docs (1 CVE)

TuxCare rebuilt @storybook/addon-docs to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

PT-2026-123650

TuxCare rebuilt @storybook/addon-docs to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

CVE-2026-107652 Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

CVE-2026-107652 Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

EUVD-2026-100766

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 1.4.1 . The root cause is that the plugin stores arbitrary submission fields in its db7_forms row. The process_bulk_action() delete handler matches any store...

PT-2026-113594

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7 forms row and the process bulk action delete handler then...

CVE-2026-107652: Authorization Bypass Through User-Controlled Key

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

WordPress Database Addon for Contact Form 7 – CFDB7 plugin <= 1.4.1 - Unauthenticated Limited File Deletion vulnerability

Unauthenticated Limited File Deletion vulnerability discovered by Sawyer in WordPress Plugin Contact Form 7 Database Addon – CFDB7 versions = 1.4.1...