@theia/ai-chat-ui (>=1.46.0-next.241, <=1.71.0-next.72), @theia/ai-claude-code (>=1.65.0, <=1.71.0-next.72) +8 more potentially affected by CVE-2026-46580 via @theia/ai-chat (>=1.46.0-next.241, <=1.71.0-next.72)

@theia/ai-chat NPM version =1.46.0-next.241, =1.46.0-next.241, =1.65.0, =1.67.0-next.56, =0.0.1, =1.62.0, =1.59.0-next.62, =1.57.0-next.37, =1.46.0-next.241, =1.46.0-next.241, =1.58.5 Source cves: CVE-2026-46580 Source advisory: MEND:CVE-2026-46580...

@theia/ai-claude-code (>=1.65.0, <=1.71.0-next.72), @theia/ai-codex (>=1.67.0-next.56, <=1.71.0-next.72) +5 more potentially affected by CVE-2026-46580 via @theia/ai-chat-ui (>=1.57.0-next.37, <=1.71.0-next.72)

@theia/ai-chat-ui NPM version =1.57.0-next.37, =1.65.0, =1.67.0-next.56, =1.63.0, =1.62.0, =1.60.0-next.43, =1.57.0-next.37, =1.68.0-next.79, =1.71.0-next.72 Source cves: CVE-2026-46580 Source advisory: MEND:CVE-2026-46580...

@theia/ai-claude-code (>=1.65.0, <=1.71.0-next.72), @theia/ai-codex (>=1.67.0-next.56, <=1.71.0-next.72) +5 more potentially affected by CVE-2026-44688 via @theia/ai-chat-ui (>=1.57.0-next.37, <=1.71.0-next.72)

@theia/ai-chat-ui NPM version =1.57.0-next.37, =1.65.0, =1.67.0-next.56, =1.63.0, =1.62.0, =1.60.0-next.43, =1.57.0-next.37, =1.68.0-next.79, =1.71.0-next.72 Source cves: CVE-2026-44688 Source advisory: MEND:CVE-2026-44688...

CVE-2026-54223

UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has privileges to, what results in Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-55886 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-55886 Source advisory: GHSA-VPMM-X3FM-QR5C...

Prototype Pollution

Overview jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Prototype Pollution via the Jodit.modules.Helpers.set function. An attacker can inject unexpected properties into Object.prototype by supplying a crafted chain...

CVE-2026-12102 UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'userid' parameter due to missing validation on a user controlled key...

CVE-2026-12102

Affected software: WordPress plugin UsersWP (Front-end login, registration, profile, members directory) up to version 1.2.63. Vulnerability: Insecure Direct Object Reference via the user_id parameter due to missing validation on a user-controlled key in uwp_usermeta, enabling an authenticated att...

EUVD-2026-37860

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'userid' parameter due to missing validation on a user controlled key...

CVE-2026-12102 UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'userid' parameter due to missing validation on a user controlled key...

CVE-2026-12102

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'userid' parameter due to missing validation on a user controlled key...

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

EUVD-2026-37843

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

CVE-2026-11357 Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress (versions up to and including 3.7.5) contains a Sensitive Information Exposure flaw in editor_assets_variables. Authenticated attackers with contributor-level access can extract license key, license owner email, a...

CVE-2026-11357 Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

Joomla! Extension 'JCE' < 2.9.99.5 Remote Code Execution

The version of the JCE Joomla Content Editor extension for the Joomla! application running on the remote host is prior to 2.9.99.5. It is, therefore, affected by an improper access control vulnerability. The extension allows the creation of new editor profiles for unauthenticated users, ultimatel...

CVE-2026-11357: Exposure of Sensitive Information to an Unauthorized Actor

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editorassetsvariables. This makes it possible for authenticated attackers, with contributor-level access and abov...

ROS-20260618-73-0008

The vulnerability of the ReadXBMImage function in the console-based ImageMagick graphics editor is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

PT-2026-50637

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the 'user id' parameter due to missing validation on a user controlled key...