OESA-2026-3593 vim security update

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Securi...

OESA-2026-3594 vim security update

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Securi...

CVE-2026-86197

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86188

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-10196

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-86189

WWBN AVideo is affected by an unauthenticated path traversal vulnerability in notify.ffmpeg.json.php . By supplying a caller-chosen value in the avideoRelativePath parameter, an attacker can write files to arbitrary locations within the application root and its subdirectories. Authentication is b...

CVE-2026-86185 Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...

EUVD-2026-71991

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

CVE-2026-10196

The Mail Mint WordPress plugin (Email Marketing, Newsletter, Email Automation & WooCommerce Emails) is affected by an unauthenticated PHP Object Injection in all versions up to and including 1.31.0 . The root cause is deserialization of untrusted input in the handle_form_submission function, whic...

CVE-2026-10196 Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940...

CVE-2026-86174

Plane (project management platform) through version 1.4.2 has a validation flaw in its public deploy-board comment endpoint . The endpoint fails to verify that a supplied issue_id belongs to the deploy board's own project, allowing authenticated attackers to post comments to arbitrary issues acro...

EUVD-2026-71946

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attackers can inject malicious container configurations with privileged settings or host path mounts th...

CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2024-11080 Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks WordPress plugin (versions 2.2.32 to 2.3.1 ) contains an Unauthenticated Hook Injection flaw via several functions in ~/includes/blocks/form-wrap/function.php, allowing unauthenticated attackers to execute actions through WordPress hooks when no ad...

EUVD-2024-55751

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2026-84937

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

CVE-2026-84931

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-84930

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...