CVE-2026-3568

CVE-2026-3568 affects the WordPress MStore API plugin up to version 4.18.3. The root cause is in update_user_profile() processing the raw JSON field 'meta_data' without validation, allowlisting, or sanitization, and then applying arbitrary keys/values to update_user_meta() after cookie-based auth...

SUSE CVE-2018-6574

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked...

The vulnerability of the “go get” implementation in the Go programming package allows a perpetrator to execute the “go get” command remotely.

The vulnerability of the “go get” command in the Golang programming language is related to the absence of blocking of arguments -fplugin= and -plugin= during the compilation of source code using GCC or Clang plugin functions. Exploiting this vulnerability allows a remote attacker to execute the “...