CLSA-2026-1771601553 Fix CVE(s): CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945

OpenJDK 8u482 release + CVE-2026-21945: enhance Certificate Checking + CVE-2026-21932: enhance Handling of URIs + CVE-2026-21933: improve HttpServer Request handling + CVE-2026-21925: improve JMX connections - Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html...

Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems

In yet another software supply chain attack, the open-source, artificial intelligence AI-powered coding assistant Cline CLI was updated to stealthily install OpenClaw, a self-hosted autonomous AI agent that has become exceedingly popular in the past few months. "On February 17, 2026, at 3:26 AM P...

CVE-2026-25378

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through = 8.2.4...

CVE-2026-25389

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through = 4.2.8.3...

CVE-2026-25305

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme XStore xstore allows DOM-Based XSS.This issue affects XStore: from n/a through = 9.6.4...

CVE-2025-12500

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to unauthenticated limited file upload in all versions up to, and including, 7.8.1. This is due to the plugin not properly verifying that a user is authorized to perform file upload actions via the...

CVE-2026-2731

Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 all and 9 9.19.7 and 9.20.3 allows unauthenticated attackers to execute code via simple web requests...

CVE-2026-2825 rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting

A vulnerability has been found in rachelos WeRSS we-mp-rss up to 1.4.8. This impacts the function fixhtml of the file tools/fix.py of the component Article Module. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

PT-2026-21127

Name of the Vulnerable Software and Affected Versions Laborator Oxygen versions n/a through 6.0.8 Description A Server-Side Request Forgery SSRF issue exists in Laborator Oxygen. This allows for Server Side Request Forgery. Recommendations Update Laborator Oxygen to a version greater than 6.0.8...

NewStart CGSL MAIN 6.06 (SP) : openssh Vulnerability (NS-SA-2026-0002)

The remote NewStart CGSL host, running version MAIN 6.06 SP, has openssh packages installed that are affected by a vulnerability: - A race condition in sshd affecting versions between 8.5p1 and 9.7p1 inclusive may allow arbitrary code execution with root privileges. Successful exploitation has be...

PT-2026-21161

Name of the Vulnerable Software and Affected Versions vanquish Upload Files Anywhere versions prior to 2.9 Description The software contains a flaw related to improper limitation of a pathname to a restricted directory, also known as a Path Traversal issue. This impacts the Upload Files Anywhere...

PT-2026-21087

Name of the Vulnerable Software and Affected Versions Mollie Payments for WooCommerce versions through 8.1.1 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Reflected Cross-site Scripting condition. The issue allows for the...

WordPress plugin Upload Files Anywhere 路径遍历漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

PT-2026-21059

Name of the Vulnerable Software and Affected Versions vanquish User Extra Fields wp-user-extra-fields versions through 16.8 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting XSS condition. This allows for...

PT-2026-21148

Name of the Vulnerable Software and Affected Versions TeconceTheme Emerce Core versions through 1.8 Description A flaw exists in TeconceTheme Emerce Core that allows for Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects the emerce-core...

Microsoft Edge (Chromium) < 145.0.3800.70 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 145.0.3800.70. It is, therefore, affected by multiple vulnerabilities as referenced in the February 20, 2026 advisory. - Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker ...

CVE-2026-26059 ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php

ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission to edit groups to store a JavaScript payload that would execute when the group was viewed in the Group View. Version 6.8.2 fixes this issue...

CVE-2026-26059 ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php

ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission to edit groups to store a JavaScript payload that would execute when the group was viewed in the Group View. Version 6.8.2 fixes this issue...

GHSA-3288-P39F-RQPV Unsoundness in opt-in ARMv8 assembly backend for `keccak`

Summary The asm! block enabled by the off-by-default asm feature, when enabled on ARMv8 targets, misspecified the operand type for all of its operands, using in for pointers and values which were subsequently mutated by operations performed within the assembly block. Impact It's unclear what...

CVE-2026-1317

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is due to insufficient escaping on the filename parameter which is stored in the database during file upload and later used in raw SQL queri...