CVE-2026-66447

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-66447

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CLSA-2026-1784164100 TuxCare security update for org.springframework (3 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 3 CVEs. Fixed in 5.1.20.RELEASE-tuxcare.3...

CLSA-2026-1783126876 TuxCare security update for @angular (5 CVEs)

TuxCare rebuilt 18 @angular packages to address 5 CVEs. Fixed in 5.1.0-tuxcare.3...

CLSA-2026-1781225629 TuxCare security update for @angular (1 CVE)

TuxCare rebuilt 18 @angular packages to address 1 CVE. Fixed in 5.1.0-tuxcare.1...

CLSA-2026-1780966310 TuxCare security update for jsonpath-plus (2 CVEs)

TuxCare rebuilt jsonpath-plus to address 2 CVEs. Fixed in 5.1.0-tuxcare.1...

EUVD-2026-50965

A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial ...

CVE-2026-67245 A path traversal vulnerability was found in the VPN Clients on the ADM

A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path. An authenticated attacker can exploit this issue to write an...

CVE-2026-67244

A format string vulnerability in ADM’s Notification OAuth settings is triggered by user-controlled notification configuration input that is processed via an unsafe format-string operation. Exploitation requires authenticated administrator privileges and can disclose memory information or cause de...

PT-2026-66359

A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside...

CVE-2026-61957

Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...

CVE-2026-12877 Software Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search Parameter

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue...

CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

EUVD-2026-48224

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

PT-2026-63882

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Guillermo Álvarez in WordPress Plugin Shiptastic for WooCommerce versions = 5.1.0...

WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Zarinpal Gateway versions = 5.1.0...

GHSA-XVCM-6775-5M9R Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Summary Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the keys inserted into a Map can craft many keys that all collide, degrading insertion and...

UBUNTU-CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...

EUVD-2026-43453

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map allows DOM-Based XSS.This issue affects Extensions for Leaflet Map: from n/a through = 5.1...