CVE-2025-12375: Server-Side Request Forgery (SSRF)

The Printful Integration for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.11 via the advanced size chart REST API endpoint. This is due to insufficient validation of user-supplied URLs before passing them to the downloadur...

WordPress Printful Integration for WooCommerce plugin <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Adrian Lukita in WordPress Plugin Printful Integration for WooCommerce versions = 2.2.11...

6 Best Continuous Threat Monitoring Platforms Reviewed

Security teams are drowning in data but starving for insight. You have logs, network traffic, and endpoint activity pouring in from all directions, but more data doesn't automatically equal better security. Without context, it’s just noise that leads to alert fatigue and missed threats. An...

CVE-2026-20138

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster SHC deployment who holds a role with access to the Splunk internal index could view the integrationKey, secretKey, and appSecretKey secrets, generated by Duo Two-Factor...

CVE-2026-20138

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster SHC deployment who holds a role with access to the Splunk internal index could view the integrationKey, secretKey, and appSecretKey secrets, generated by Duo Two-Factor...

CVE-2026-20138

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster SHC deployment who holds a role with access to the Splunk internal index could view the integrationKey, secretKey, and appSecretKey secrets, generated by Duo Two-Factor...

CVE-2026-20138 Sensitive Information Disclosure in "_internal" index in Splunk Enterprise

In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster SHC deployment who holds a role with access to the Splunk internal index could view the integrationKey, secretKey, and appSecretKey secrets, generated by Duo Two-Factor...

org.jenkins-ci.main:jenkins-war (1.653), org.jenkins-ci.main:test (1.653) +9 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.653)

org.jenkins-ci.main:jenkins-core MAVEN version 1.653 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.653 - org.jenkins-ci.main:test 1.653 -...

CVE-2026-1938 YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpoint

The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the /yaymail-license/v1/license/delete REST endpoint in versions up to, and including, 4.3.2. This makes it possible for authenticated...

CVE-2026-1925 EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification

The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'updatetemplatedata' function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with...

STERNBERG SD.NET RIM Cross-Site Request Forgery Vulnerability

STERNBERG SD.NET RIM is a government affairs integration system developed by the British company STERNBERG. Versions of STERNBERG SD.NET RIM prior to 4.7.3c contained a cross-site request forgeing vulnerability. This vulnerability allowed attackers to inject malicious SQL statements through POST...

PT-2026-20469

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.0 Splunk Enterprise versions prior to 10.0.2 Splunk Enterprise versions prior to 9.4.7 Splunk Enterprise versions prior to 9.3.9 Splunk Enterprise versions prior to 9.2.11 Description A user with access...

NVIDIA Megatron Bridge code injection vulnerability

NVIDIA Megatron Bridge is a component developed by NVIDIA Corporation in the United States that connects Hugging Face and Megatron-Core. NVIDIA Megatron Bridge has a code injection vulnerability. This vulnerability arises from malicious inputs in the data shuffling tutorial, which may lead to cod...

PT-2026-20382

The Brevo - Email, SMS, Web Push, Chat, and more. plugin for WordPress is vulnerable to authorization bypass due to type juggling in all versions up to, and including, 3.3.0. This is due to the use of loose comparison == instead of strict comparison === when validating the installation ID in the...

CVE-2025-36348 The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway is Vulnerable to Information Disclosure

IBM Sterling B2B Integrator versions 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 through 6.2.1.1, and IBM Sterling File Gateway versions 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 through 6.2.1.1 may expose sensitive information to a remote privileged attack...

de.ck35.monitoring:request-tagging-integration-tomcat (0.5.0), org.apache.geode:geode-modules-tomcat7 (>=1.0.0-incubating, <=1.1.1) +8 more potentially affected by CVE-2026-24733 via org.apache.tomcat:tomcat-coyote (7.0.70)

org.apache.tomcat:tomcat-coyote MAVEN version 7.0.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - de.ck35.monitoring:request-tagging-integration-tomcat 0.5.0 -...

org.apache.cxf.fediz:fediz-tomcat8 (1.4.5), org.apache.tomcat:tomcat-catalina (8.5.34) +7 more potentially affected by CVE-2026-24733 via org.apache.tomcat:tomcat-coyote (8.5.34)

org.apache.tomcat:tomcat-coyote MAVEN version 8.5.34 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - org.apache.cxf.fediz:fediz-tomcat8 1.4.5 - org.apache.tomcat:tomcat-catalina 8.5.34 -...

com.spatineo:geoserver-tomcat8-valve (1.0), org.apache.tomcat:tomcat-catalina (8.5.46) +11 more potentially affected by CVE-2026-24733 via org.apache.tomcat:tomcat-coyote (8.5.46)

org.apache.tomcat:tomcat-coyote MAVEN version 8.5.46 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - com.spatineo:geoserver-tomcat8-valve 1.0 - org.apache.tomcat:tomcat-catalina 8.5.46 -...

CVE-2025-14289

IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2025-14289

IBM webMethods Integration Server 12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...