PT-2026-64031

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

PT-2026-63875

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

PT-2026-63924

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

PT-2026-64032

Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 2.0.1 Description Improper validation of order parameters allows an unauthenticated SQL injection, which is a technique used to manipulate database queries. This issue enables full read access to the database,...

CVE-2026-65761: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...

PT-2026-64078

Insecure Permission Assignment for Garmin OAuth Token Store Summary garminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmin tokens.json was created world-readable 0o644. The file contains the DI...

PT-2026-64038

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

CVE-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Ebook Store versions = 6.19...

WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin Ebook Store versions = 6.19...

The vulnerability of the function nvme_ctrl_dhchap_ctrl_secret_store() in the driver/nvme/host/core.c file of the Linux operating system’s NVME kernel driver, which allows a hacker to cause a service failure.

The vulnerability of the nvmectrldhchapctrlsecretstore function in the drivers/nvme/host/core.c file of the Linux NVME driver is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...

Kibana 9.4.3 Security Update (ESA-2026-58)

Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated...

Malicious Package

Overview vulndify-mcp-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-11876

In zenml-io/zenml version 0.94.2, the GET /api/v1/stack-deployment/stack endpoint getdeployedstack lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector...

Malicious Package

Overview VLifeGram is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview wei516-ppa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview xorg-renderproto is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview wallet-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...