PT-2026-63894

Unauthenticated Broken Access Control in Kit formerly ConvertKit = 3.3.5 versions...

PT-2026-63957

Name of the Vulnerable Software and Affected Versions JetBrains GoLand versions prior to 2026.2 Description Arbitrary code execution is possible before granting project trust through the configured Go SDK. Recommendations Update JetBrains GoLand to version 2026.2...

PT-2026-63923

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65503: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

ml-medic-kit (>=0.1.9, <=0.2.1) potentially affected by CVE-2026-73415 via jupyterlab (1.2.6)

jupyterlab PYPI version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - ml-medic-kit =0.1.9, =0.2.1 Source cves: CVE-2026-73415 Source advisory: OSV:GHSA-GX64-GJ6P-PC4C...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Steven Julian in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.6.2...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.6.2...

WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kit formerly ConvertKit versions = 3.3.5...

PT-2026-63903

Name of the Vulnerable Software and Affected Versions LA-Studio Element Kit for Elementor versions prior to 1.6.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above ...

CVE-2026-61053

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications component: Diameter Gateway and SDK. Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacke...

UBUNTU-CVE-2026-47021

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...

UBUNTU-CVE-2026-47063

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

GHSA-8Q5V-6PQQ-X66H vulnerabilities

Vulnerabilities for packages: dotnet, dotnet-sdk, dotnet-bootstrap, promitor, powershell...

cvexplore (>=0.2.6.0, <=0.2.6.1), meloetta (1.1.0) +4 more potentially affected by CVE-2026-59890 via setuptools (58.0.0)

setuptools PYPI version 58.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - cvexplore =0.2.6.0, =0.0.1, =0.3.1, =1.3.0, =1.6.0 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

Malicious Package

Overview agents-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

fastjson-1.2.83-poc

Fastjson 1.2.83 RCE PoC Fastjson 1.2.66–1.2.83: Script for v...

2026-Fastjson-RCE-PoC

2026 Fastjson RCE PoC Fastjson 1.2.66–1.2.83: Script for ver...

📄 WordPress WP Directory Kit 1.4.3 Unauthenticated Blind SQL Injection

WordPress WP Directory Kit plugin version 1.4.3 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...