GHSA-6HQM-HM2V-3P2P vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, jitsucom-jitsu, opensearch-dashboards, kubeflow-centraldashboard, prism, lerna...

CVE-2026-67319 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, jitsucom-jitsu, opensearch-dashboards, kubeflow-centraldashboard, prism, lerna...

GHSA-9WX3-P993-35VP vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, jitsucom-jitsu, opensearch-dashboards, kubeflow-centraldashboard, prism, lerna...

GHSA-68JP-44VC-2X5H vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, jitsucom-jitsu, opensearch-dashboards, kubeflow-centraldashboard, prism, lerna...

CVE-2026-67320 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, jitsucom-jitsu, opensearch-dashboards, kubeflow-centraldashboard, prism, lerna...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, opensearch-dashboards, azurite, arangodb, prism, langfuse-fips, wazuh-dashboard, jitsucom-jitsu, lerna, gitlab-rails-ce-fips, semaphore, gitlab-rails-ce, langfuse, wazuh-dashboard-fips, awx, librechat, nextcloud-server,...

GHSA-4WW2-RJH2-XPV9 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, jitsucom-jitsu, opensearch-dashboards, kubeflow-centraldashboard, prism, lerna...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: langfuse, nextcloud-server, jitsucom-jitsu, opensearch-dashboards, kubeflow-centraldashboard, prism, lerna...

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'lsddisplstyle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Listdom versions = 5.8.1...

WordPress User Profile Builder plugin <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Profile Builder versions = 4.0.0...

WordPress Events Manager plugin <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter vulnerability

Reflected Cross-Site Scripting via 'headerformat' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Manager versions = 7.4.0.1...

WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion vulnerability

Authenticated Administrator+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Manager versions = 7.3.7.4...

Malicious code in prism-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6570c9056bf020fdada0366045c4e91a0f5cb21171fe27df9fcea82259e7809 The package declares preinstall: "node index.js", which fires automatically on npm install. index.js collects host identifiers os.hostname,...

MAL-2026-14139 Malicious code in prism-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6570c9056bf020fdada0366045c4e91a0f5cb21171fe27df9fcea82259e7809 The package declares preinstall: "node index.js", which fires automatically on npm install. index.js collects host identifiers os.hostname,...

WordPress WP Compress plugin <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Compress versions = 7.10.09...

WordPress Product Table & List Builder For WooCommerce plugin <= 5.6.0 - Unauthenticated CSS Injection via 'laptop_scroll_offset' Parameter vulnerability

Unauthenticated CSS Injection via 'laptopscrolloffset' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WooCommerce Product Table Lite versions = 5.6.0...

WordPress Contest Gallery plugin <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability

Authenticated Author+ Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Contest Gallery versions = 30.0.7...

WordPress Image Uploader for Welcart plugin <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability

Authenticated Author+ SQL Injection via Attachment 'posttitle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Image Uploader for Welcart versions = 1.4.6...

WordPress Bit Form plugin <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'filterText' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Bit Form versions = 3.2.0...