PT-2026-31295

Name of the Vulnerable Software and Affected Versions Advanced Members for ACF plugin for WordPress versions up to and including 1.2.5 Description The Advanced Members for ACF plugin for WordPress has a flaw that allows authenticated attackers with Subscriber-level access or higher to delete...

CVE-2026-0814: Missing Authorization

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vszcf7exporttoexcel' function in all versions up to, and including, 2.0.9. This makes it possible for authenticated attackers, with Subscriber-level access an...

WordPress plugin Advanced Coupons for WooCommerce Coupons 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

CVE-2026-39508: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows DOM-Based XSS.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through =...

WordPress plugin Advanced Contact form 7 DB 跨站请求伪造漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress plugin Advanced Contact form 7 DB 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

SUSE CVE-2026-28386

Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service fo...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the AES-CFB-128 process on x86-64 systems with AVX-512 and VAES support when processing partial cipher blocks. An attacker can cause a crash and application termination by providing input buffers that end at a memo...

CVE-2026-39349

CVE-2026-39349 affects OrangeHRM Open Source versions 5.0 through 5.8, where certain sensitive fields were encrypted with AES in ECB mode, preserving block patterns and enabling potential pattern disclosure in stored data. The issue is fixed in 5.8.1. Details confirmed by the provided description...

CVE-2026-39342

ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports Query Menu and access to the "Advanced Search" query. This vulnerability is...

CVE-2026-39342 ChurchCRM has a SQL injection searchwhat parameter via QueryView.php

ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports Query Menu and access to the "Advanced Search" query. This vulnerability is...

CVE-2026-39342 ChurchCRM has a SQL injection searchwhat parameter via QueryView.php

ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports Query Menu and access to the "Advanced Search" query. This vulnerability is...

CVE-2026-39342

ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports Query Menu and access to the "Advanced Search" query. This vulnerability is...

CVE-2026-39342

ChurchCRM prior to 7.1.0 is vulnerable to SQL injection via the searchwhat parameter (QueryView.php?QueryID=15) when accessed by an authenticated user with Data/Reports > Query Menu and the Advanced Search query. Root cause: improper input handling enables SQL injection. Impact is high for con...

CVE-2026-39342 ChurchCRM has a SQL injection searchwhat parameter via QueryView.php

ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports Query Menu and access to the "Advanced Search" query. This vulnerability is...

CVE-2026-4740

A flaw was found in Open Cluster Management OCM, the technology underlying Red Hat Advanced Cluster Management ACM. Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This...

gstreamer-plugins-ugly: GStreamer: Arbitrary code execution via ASF file processing

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the ASF Demuxer component allows a remote attacker to execute arbitrary code. The issue arises from insufficient validation of user-supplied data length when processing stream headers within ASF Advanced Systems Forma...

anyclassifier (>=0.1.1, <=0.2.0), autotrain-advanced (>=0.7.30, <=0.7.43) +3 more potentially affected by CVE-2026-1839 via transformers (4.39.0)

transformers PYPI version 4.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - anyclassifier =0.1.1, =0.7.30, =0.1.3, =0.2.3, =0.2.4 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...

autotrain-advanced (>=0.8.7, <=0.8.8), bloombee (>=0.1.1, <=0.1.3) +7 more potentially affected by CVE-2026-1839 via transformers (4.43.1)

transformers PYPI version 4.43.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.8.7, =0.1.1, =1.0.0, =1.1.28.14, =0.1.0, =0.3.8, =1.1.0, =1.2.2 - turbo-alignment 0.0.4 Source cves: CVE-2026-183...

autotrain-advanced (>=0.8.26, <=0.8.33), construe (>=0.2.0, <=0.4.0) +17 more potentially affected by CVE-2026-1839 via transformers (4.46.2)

transformers PYPI version 4.46.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - autotrain-advanced =0.8.26, =0.2.0, =0.25.0, =1.1.1, =0.1.0, =0.0.9, =0.1.60, =0.1.1, =1.1.3, =0.2.4, =0.1.1, =0.1.4, =2.0.0, =0.1.0,...