EUVD-2026-63548

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...

WordPress Saitama Addon Pack plugin <= 1.0.8 - Contributor+ Stored XSS via Post Meta vulnerability

Contributor+ Stored XSS via Post Meta vulnerability discovered by testoun in WordPress Plugin Saitama Addon Pack versions = 1.0.8...

CVE-2026-76220

GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...

EUVD-2026-60918

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-66633 WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.12...

PT-2026-77061

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-66633: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

Security Bulletin: IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information (CVE-2026-1014)

Summary A sensitive information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2026-1014 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to exposure of sensitive information via JSON server respon...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: wasmcloud, samply, uv, oranda, zizmor, lychee, kdash, qdrant, deno, sccache, tealdeer, parseable, sqlx, nushell, zed, zola, shadowsocks-rust, wash, sdp-k8s-injector, cargo-audit, wadm, rye, pixi, linkerd2-proxy, wasm-pack, atuin, ntpd-rs, rustup, xh, rustls-ffi,...

io.zerows:zero-boot-actor (1.0.50), io.zerows:zero-boot-cloud-actor (1.0.50) +17 more potentially affected by CVE-2026-72645 via org.elasticsearch:elasticsearch (>=9.0.0, <=9.4.4)

org.elasticsearch:elasticsearch MAVEN version =9.0.0, =0.102.0, =9.4.0, =9.4.0, =9.0.0, =9.4.4 and more Source cves: CVE-2026-72645 Source advisory: MEND:CVE-2026-72645...

org.elasticsearch.plugin:x-pack-esql (9.5.0), org.elasticsearch.plugin:x-pack-esql-compute (9.5.0) +3 more potentially affected by CVE-2026-72645 via org.elasticsearch:elasticsearch (9.5.0)

org.elasticsearch:elasticsearch MAVEN version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch.plugin:x-pack-esql 9.5.0 - org.elasticsearch.plugin:x-pack-esql-compute 9.5.0 -...

org.elasticsearch.plugin:x-pack-esql (9.5.0), org.elasticsearch.plugin:x-pack-esql-compute (9.5.0) +3 more potentially affected by CVE-2026-72678 via org.elasticsearch:elasticsearch (9.5.0)

org.elasticsearch:elasticsearch MAVEN version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch.plugin:x-pack-esql 9.5.0 - org.elasticsearch.plugin:x-pack-esql-compute 9.5.0 -...

org.elasticsearch.plugin:x-pack-esql (>=9.4.0, <=9.4.4), org.elasticsearch.plugin:x-pack-esql-compute (>=9.4.0, <=9.4.4) +4 more potentially affected by CVE-2026-72678 via org.elasticsearch:elasticsearch (>=9.4.0, <=9.4.4)

org.elasticsearch:elasticsearch MAVEN version =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.2, =9.4.4 Source cves: CVE-2026-72678 Source advisory: MEND:CVE-2026-72678...

org.elasticsearch.plugin:x-pack-esql (9.5.0), org.elasticsearch.plugin:x-pack-esql-compute (9.5.0) +3 more potentially affected by CVE-2026-72687 via org.elasticsearch:elasticsearch (9.5.0)

org.elasticsearch:elasticsearch MAVEN version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch.plugin:x-pack-esql 9.5.0 - org.elasticsearch.plugin:x-pack-esql-compute 9.5.0 -...

org.elasticsearch.plugin:x-pack-esql (>=9.4.0, <=9.4.3), org.elasticsearch.plugin:x-pack-esql-compute (>=9.4.0, <=9.4.3) +4 more potentially affected by CVE-2026-72683 via org.elasticsearch:elasticsearch (>=9.4.0, <=9.4.3)

org.elasticsearch:elasticsearch MAVEN version =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.3 - pl.allegro.tech.elasticsearch.plugin:elasticsearch-analysis-morfologik 9.4.2 Source cves: CVE-2026-72683 Source advisory: MEND:CVE-2026-72683...

WordPress Buttons Mega Pack Pro plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Buttons Mega Pack Pro versions = 2.5...

PYSEC-2026-3953

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

PYSEC-2026-3953

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...