CVE-2026-24961

CVE-2026-24961 is a Server-Side Request Forgery (SSRF) affecting ThemeGoods WordPress Grand Blog theme (Grand Blog) versions prior to 3.1.5, where the grandblog component is vulnerable. The root cause is SSRF in Grand Blog prior to 3.1.5, enabling an attacker to trigger requests from the server. ...

WordPress Salon booking system plugin < 9.6.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by cyc707 in WordPress Plugin Salon booking system versions 9.6.3...

WordPress User Profile Builder plugin < 3.15.2 - Unauthenticated Arbitrary Password Reset vulnerability

Unauthenticated Arbitrary Password Reset vulnerability discovered by Drew Webber mcdruid in WordPress Plugin Profile Builder versions 3.15.2...

PT-2026-6549

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.2.4 PrestaShop versions prior to 9.0.3 Description PrestaShop contains a time-based user enumeration issue in its user authentication functionality. An attacker can determine if a customer account exists by...

PT-2026-6191

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda AC7 firmware versions prior to V03.03.03.01 cn Description The web management interface lacks CSRF protections for administrative functions. The interface does not enforce anti-CSRF tokens or robust origin validation. This could...

Google Chrome < 104.0.5112.102 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 104.0.5112.102. It is, therefore, affected by multiple vulnerabilities as referenced in the 202208stable-channel-update-for-desktop16 advisory. - Use after free in Browser Creation in Google Chrome prior to 104.0.5112.1...

CVE-2026-22226 Command Injection Vulnerability on TP-Link Archer BE230 and AX73

A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Archer AX73 v2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe...

CVE-2026-22221 Command Injection Vulnerability on TP-Link Archer BE230 v1.2

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2vpn modules allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity...

CVE-2025-69420 affecting package openssl for versions less than 3.3.5-2

CVE-2025-69420 affecting package openssl for versions less than 3.3.5-2. A patched version of the package is available...

CVE-2025-68160 affecting package openssl for versions less than 3.3.5-2

CVE-2025-68160 affecting package openssl for versions less than 3.3.5-2. A patched version of the package is available...

CVE-2026-24747 affecting package pytorch for versions less than 2.2.2-11

CVE-2026-24747 affecting package pytorch for versions less than 2.2.2-11. A patched version of the package is available...

CVE-2025-15468 affecting package openssl for versions less than 3.3.5-2

CVE-2025-15468 affecting package openssl for versions less than 3.3.5-2. A patched version of the package is available...

CVE-2025-59465 affecting package nodejs for versions less than 20.14.0-11

CVE-2025-59465 affecting package nodejs for versions less than 20.14.0-11. A patched version of the package is available...

CVE-2025-15467 affecting package openssl for versions less than 3.3.5-2

CVE-2025-15467 affecting package openssl for versions less than 3.3.5-2. A patched version of the package is available...

CVE-2026-21637 affecting package nodejs for versions less than 20.14.0-11

CVE-2026-21637 affecting package nodejs for versions less than 20.14.0-11. A patched version of the package is available...

WordPress WP Affiliate Platform plugin < 6.5.1 - Reflected XSS via Registration Form vulnerability

Reflected XSS via Registration Form vulnerability discovered by Bob Matyas in WordPress Plugin Affiliate Manager versions 6.5.1...

WordPress WP eStore plugin < 8.5.5 - Reflected XSS in Customer Editing vulnerability

Reflected XSS in Customer Editing vulnerability discovered by Bob Matyas in WordPress Plugin WP eStore versions 8.5.5...

CVE-2025-15030

CVE-2025-15030 affects the WordPress plugin User Profile Builder up to version 3.15.2. The vulnerability arises from an improper password reset flow, allowing unauthenticated actors to reset any user’s password by supplying a username (e.g., administrator) and a crafted request; no valid reset to...

CVE-2026-25202

The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1...

CVE-2026-25202

The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1...