FLock.io Unveils Edge Decision Model, Built on Qwen, for Enhanced Data Privacy

Built on Qwen3.5-2B, the System One model executes sub-31ms local inference, allowing enterprises to run automated classifications quickly, at low cost and completely offline without transmitting sensitive data to third-party cloud servers...

WordPress Visma Pay for WooCommerce plugin < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure vulnerability

Unauthenticated Payment Bypass and Order Data Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Visma Pay for WooCommerce versions 1.2.2...

CVE-2026-108291

The itthinx Affiliates WordPress plugin, versions up to and including 7.0.1 , is vulnerable to a PHP Object Injection flaw caused by the deserialization of untrusted data . This vulnerability allows an attacker to perform Object Injection , which can lead to significant impacts on confidentiality...

CVE-2026-108291 WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1...

EUVD-2026-101017

Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1...

CVE-2026-106599 WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3...

CVE-2026-106599

The SureCart WordPress plugin (versions up to and including 4.9.3 ) is vulnerable to a PHP Object Injection flaw caused by the deserialization of untrusted data . An attacker could potentially exploit this to perform object injection, leading to high confidentiality, integrity, and availability i...

CVE-2026-97278 WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9...

EUVD-2026-101009

Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9...

CVE-2026-97278 WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9...

CVE-2026-97278

The WP SYNTEX Polylang plugin (versions up to and including 3.8.9 ) is vulnerable to a PHP Object Injection flaw caused by the deserialization of untrusted data in the polylang component. This vulnerability allows for high-impact consequences regarding confidentiality, integrity, and availability...

CLSA-2026-1791979377 TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.7.18-tuxcare.9...

RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory...

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to improper reuse of pooled FTP connections previously authenticated with client certificates. An attacker can gain unauthorized access to remote server resources by initiating an unencrypte...

DEBIAN-CVE-2026-88842

A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...

CVE-2026-88842

A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...

DEBIAN-CVE-2026-101338

When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...

CVE-2026-101338

When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...

CVE-2026-101337

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...

CVE-2026-101341 Stack overwrite from specially formatted TXT-DATA RDATA field

Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...