CVE-2026-7534

The CVE-2026-7534 entry details a vulnerability in the SUMO Reward Points for WooCommerce plugin (WordPress) up to version 32.7.0. Affected component: SRP_REST_Earning_Controller handling REST endpoint /wp-json/wc-srp/v1/earning. Root cause: the user_has_cap filter unconditionally grants the rs_e...

CVE-2026-7534

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...

github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

PT-2026-63928

Unauthenticated Cross Site Request Forgery CSRF in WP Activity Log = 5.6.4 versions...

GoLand -- Multiple vulnerabilities

https://www.jetbrains.com/privacy-security/issues-fixed/ reports: In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

CVE-2026-64800: Insertion of Sensitive Information into Log File

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

PT-2026-63955

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

CVE-2026-64872: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory...

PT-2026-63602

Custom purge and log paths could escape the site webroot directory...

CVE-2026-65512: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...

EUVD-2026-43646

Eclipse Jetty: HTTP Authority/Host mismatch...

Cleartext Storage of Sensitive Information

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the process that handles Google Service Account credentials, where the full PEM private key is placed in the JWT header's kid field instead of a key...

Security update for ImageMagick

This update for ImageMagick fixes the following issues CVE-2026-56375: possible memory leak in ASHLAR coder when action fails bsc1271495. CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title bsc1271496. CVE-2026-61859: policy bypass in script operation due to missing chec...

Insertion of Sensitive Information into Log File

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the process that handles HTTP header credentials in LLM sub-node execution data. An attacker can obtain sensitive API keys and secrets by accessin...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187 Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187

The CVE-2026-44187 vulnerability affects the Ansible Lightspeed extension for Visual Studio Code. It allows a local attacker or malware operating with the user’s privileges to read the Google Gemini API key because the extension stores the credential in plaintext in the user’s configuration file ...

CVE-2026-44187 Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...