CVE-2026-73078 Vim: Arbitrary Code Execution via Netrw Menu Construction

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078

Vim (open source editor) firmware prior to 9.2.0840 is vulnerable via the netrw menu construction. The vulnerability arises when netrwPlugin.vim loads netrw and autoload/netrw.vim builds Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into :menu c...

CVE-2026-73078 Vim: Arbitrary Code Execution via Netrw Menu Construction

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

PT-2026-70268

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

EUVD-2026-55655

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An...

Malicious code in streak-calendar-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...

CVE-2026-7105 Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2026-7105

CVE-2026-7105 affects the WordPress plugin Xpro Addons up to version 1.5.1. The root cause is a missing capability check in the get_menu_content_editor() function, allowing authenticated users with Subscriber+ privileges to create arbitrary published posts of the xpro_content CPT. The created pos...

Security update for vifm (important)

openSUSE Security Update: Security update for vifm Announcement ID: openSUSE-SU-2026:0276-1 Rating: important References: 1273413 Cross-References: CVE-2026-8997 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for...

CVE-2026-15385

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

CVE-2026-11872

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...

CVE-2026-11872 Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...

CVE-2026-15385 RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

CVE-2026-15385 RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

CVE-2026-15385

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

CVE-2026-11872

CVE-2026-11872 affects the Clever Mega Menu for Visual Composer WordPress plugin (

EUVD-2026-51939

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...

CVE-2026-15385

Affected software: RT Mega Menu WordPress plugin (before 1.5.2). Vulnerability summary: Lack of a proper capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings. The only gate is a nonce readable by any logged-in user, allowing a subscriber-level user to ...

CVE-2026-11872

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...

EUVD-2026-51936

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...