WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Broken Access Control vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

PT-2026-63927

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

PT-2026-64212

Name of the Vulnerable Software and Affected Versions React Router versions 6.4.0 through 7.17.0 Description In Framework Mode and Data Mode applications performing manual SSR Server-Side Rendering, a flaw exists where attacker-supplied input can overwrite specific aspects of errors caught during...

PT-2026-63934

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

PT-2026-64150

An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint. Depending on how the RHCS server is configured, a manual intervention to restart it may prove necessary...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

CVE-2026-42210

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.640, for Webmin accounts that require a second authentication factor typically TOTP, an attacker with knowledge of the username and password can bypass the 2FA requirement by using Basic authentication...

CVE-2026-42210

Webmin prior to 2.640 contains a 2FA bypass where an attacker who knows a valid Webmin username and password can bypass the second authentication factor by authenticating with Basic authentication. The issue is documented with a CVSS 4.0 vector and a base score of 5.3 (MEDIUM). The recommended re...

PT-2026-61652

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.640 Description Webmin is a web-based system administration tool for Unix-like servers. An attacker who possesses a valid username and password can bypass the two-factor authentication 2FA requirement, such as...

deep-pentest-skill

Deep Pentest Skill !License: MIThttps://img.shields.io/bad...

vulnerabilities handled in Mozilla Firefox

Mozilla has identified vulnerabilities in Firefox, specifically in version 152.0.6. Through a combination of two vulnerabilities, malicious actors can execute malicious code on victims’ systems remotely. For successful exploitation, users must visit a malicious website or a legitimate website wit...

PT-2026-58973

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

VulnCheck KEV: CVE-2026-9282

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

PT-2026-59551

Summary Direct insertion of unescaped user input into template-rendering tools allows arbitrary code execution via specially crafted agent instructions. Details The create agent centric tools function returns tools like acp create file that process file content using template rendering. When user...

PT-2026-59657

Impact Given a malformed % case % tag without associated % when % or % else % block, and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time. This allows malicious template authors to craft templates for a denial of service attack. Patches The issue is fixed in...

PT-2026-60008

Summary The utcp-http plugin is vulnerable to a blind Server-Side Request Forgery SSRF caused by a trust-boundary inconsistency between manual discovery and tool invocation. register manual validates the discovery URL against an HTTPS / loopback allowlist, but call tool and call tool streaming...

PT-2026-59409

Summary Manually modifying chat history allows setting the html property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponised document...

EUVD-2026-43164

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-9282 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-9282 W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...