BIT-JOOMLA-2026-71574 Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

...

drm/amdkfd: Add bounds check for CRAT subtype length

...

Integrity Check Bypass

Spring for GraphQL is vulnerable to an integrity check bypass. The vulnerability is due to loading JavaScript libraries from a public CDN without Subresource Integrity checks, where an attacker can inject malicious code into those scripts and execute arbitrary code on the browser loading the...

CVE-2026-84146

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

Malicious code in check-slip-chii (npm)

--- Credit: OpenSSF source...

Malicious code in check-readstream (npm)

The package check-readstream was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in check-type-array (npm)

The package check-type-array was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in check-google-play-card-balance031 (npm)

The package check-google-play-card-balance031 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in check-deps-version-consistency (npm)

--- Credit: OpenSSF source...

Malicious code in check-deps-ver-consistency (npm)

--- Credit: OpenSSF source...

Malicious code in check-readstream-really-awesome-totally-secure-i-think (npm)

The package check-readstream-really-awesome-totally-secure-i-think was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in check-google-play-card-balance127 (npm)

The package check-google-play-card-balance127 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in check-dependency-ver-consistency (npm)

--- Credit: OpenSSF source...

Apache Spark doAs Command Injection RCE (CVE-2022-33891)

Exploits CVE-2022-33891 command injection in the Spark ACL check when spark.acls.enable is true. Sends a crafted doAs POST parameter to run arbitrary shell commands as the Spark process user. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Spark doAs command injection RCE CVE-2022-33891 —...

EUVD-2026-70913

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-84146

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, versions before 1.7.8 , contains a vulnerability where it fails to perform required capability or post-status checks. This allows unauthenticated visitors to retrieve sensitive details—including title, price, SKU, description, and sto...

EUVD-2026-70907

The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...

EUVD-2026-70906

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

CVE-2026-79632 WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...