Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Pak for Watson AIOps (CVE-2021-44228)

Summary A vulnerability was identified within the Apache Log4j library that is used by IBM Cloud Pak for Watson AIOps. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system,...

WordPress Divi Plus plugin <= 2.4.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by ShinThink in WordPress Plugin Divi Plus versions = 2.4.0...

CVE-2026-107821

A flaw was found in MariaDB. An attacker able to place a crafted table format FRM metadata file into the database data directory can exploit insufficient validation of metadata boundaries and field counts when the server opens the file. This could lead to out-of-bounds memory operations,...

CVE-2026-107818

A flaw was found in MariaDB. An authenticated database user with file write permissions can create an unauthorized configuration file in the service runtime directory. During a subsequent service restart, the service unit loads this file and injects attacker-controlled environment variables into...

WordPress WP File Download plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Deletion/Modification vulnerability discovered by t4g0 in WordPress Plugin WP File Download versions = 6.3.9...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 34.0.10 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by whatm in WordPress Plugin PPOM for WooCommerce versions = 34.0.10...

CVE-2026-107824

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

WordPress FV Player 8 plugin <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Supakiad S. m3ez in WordPress Plugin FV Player 8 versions = 8.1.7...

CVE-2026-107824 x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-107824 x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-107824

The x64dbg-MCP Server plugin, a native Model Context Protocol (MCP) tool for x64dbg, is vulnerable to an authentication bypass in versions prior to 1.1 . The software exposes full debugger functionality over HTTP and SSE while listening on the default interface (0.0.0.0 ) without authentication. ...

WordPress SiteOrigin Widgets Bundle plugin <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin SiteOrigin Widgets Bundle versions = 1.74.3...

CVE-2026-98312

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA 6fire USB audio driver. When processing incoming audio data, the driver improperly calculates buffer sizes based on device-reported packet lengths without sufficient bounds checking. An attacker capable of connecting a...

WordPress Post Export Import with Media plugin <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin Post Export Import with Media versions = 1.17.1...

DEBIAN-CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

AZL-107963 CVE-2026-108119 affecting package busybox 1.36.1-27

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-108156

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

WordPress Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin <= 3.4.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Extensions For CF7 versions = 3.4.5...