EUVD-2026-53886

Unauthenticated Cross Site Scripting XSS in Events Manager = 7.4.1 versions...

CVE-2026-66457

CVE-2026-66457 describes an unauthenticated cross-site scripting (XSS) vulnerability in the WordPress Events Manager plugin version ≤ 7.4.1. The issue is identified as an XSS flaw; no root-cause specifics are provided in the documents. Exploitation status and precise impact vectors are not detail...

EUVD-2026-53984

Shop manager Privilege Escalation in Order Delivery Date for WooCommerce = 4.6.0 versions...

CVE-2026-65559

The CVE relates to a privilege-escalation issue in the WordPress plugin Order Delivery Date for WooCommerce, affecting versions up to 4.6.0. The vulnerability targets the shop manager role within the plugin’s delivery date functionality. The provided data constrain the impact to a privilege escal...

CVE-2026-65554

The CVE-2026-65554 entry concerns the WordPress AnsPress – Question and Answer plugin version 4.4.4, with a Broken Access Control vulnerability affecting subscribers. The available connected sources confirm the affected software and the underlying issue as access control in the plugin’s subscribe...

EUVD-2026-53955

Unauthenticated Broken Access Control in SureCart = 4.6.2 versions...

EUVD-2026-53942

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-66712

CVE-2026-66712 affects the WordPress plugin Simple Membership versions

EUVD-2026-53853

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue...

CVE-2026-54225

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...

CVE-2026-13153

The CVE-2026-13153 entry concerns the Gutenberg Essential Blocks WordPress plugin prior to 6.4.0. The issue is that a public REST route is not access-restricted and the response over-fetches a non-public WooCommerce per-product sales metric, allowing unauthenticated users to read the lifetime num...

EUVD-2026-53736

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...

CVE-2026-13153 Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published...

CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

EUVD-2026-53710

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-18991 nanocoai NanoClaw send_file core.ts path traversal

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component sendfile. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.7-0.1.hum1 aarch64, x8664 grafana12.4-12.4.7-0.1.hum1.src src Security Fixes: grafana12.4: CVE-2026-69192...

EUVD-2026-53677

A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmentencode validates only the standalone segment length via FileSegmentGetMaxDataSize and does not verify the residual capacity of the current ASDU frame befo...

Security update for php8 (critical)

openSUSE security update: security update for php8 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21532-1 Rating: critical References: bsc1273075 bsc1273076 bsc1273077 bsc1273078 Cross-References: CVE-2026-17543 CVE-2026-17544 CVE-2026-7260...

AlmaLinux 9 : nodejs:24 (ALSA-2026:47057)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47057 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...