CVE-2026-1750

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...

CVE-2026-1750 Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...

EUVD-2026-5834

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'savecustomuserprofilefields' function. This makes it possible for authenticated attackers, with...

PT-2026-8223

Name of the Vulnerable Software and Affected Versions Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress versions through 7.0.7 Description The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is susceptible to a privilege escalation issue. An authenticated attacker...

CVE-2026-23118: Concurrent Execution using Shared Resource with Improper Synchronization

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix data-race warning and potential load/store tearing Fix the following: BUG: KCSAN: data-race in rxrpcpeerkeepaliveworker / rxrpcsenddatapacket which is reporting an issue with the reads and writes to -lasttxat in:...

CLSA-2026-1771009339 Update of nss

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "ePKI Root Certification Authority" - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go...

Malicious Package

Overview responsible-ai is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

How to find and remove credential-stealing Chrome extensions

Researchers have found yet another family of malicious extensions in the Chrome Web Store. This time, 30 different Chrome extensions were found stealing credentials from more than 260,000 users. The extensions rendered a full-screen iframe pointing to a remote domain. This iframe overlaid the...

PT-2026-8028

Name of the Vulnerable Software and Affected Versions Windows Notepad versions prior to 11.x patch Description A remote code execution issue exists in the modern Windows 11 Notepad application distributed through the Microsoft Store. A malicious Markdown .md file can trigger command injection,...

PT-2026-7947

Name of the Vulnerable Software and Affected Versions GFI Archiver affected versions not specified Description A flaw exists in GFI Archiver related to the configuration of the MArc.Store.Remoting.exe process. The issue stems from insufficient validation of user-supplied data, leading to the...

GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the...

First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials

Cybersecurity researchers have discovered what they said is the first known malicious Microsoft Outlook add-in detected in the wild. In this unusual supply chain attack detailed by Koi Security, an unknown attacker claimed the domain associated with a now-abandoned legitimate add-in to serve a fa...

WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Lorem Ipsum | Books & Media Store versions = 1.2.6...

WordPress Extreme Store theme <= 1.5.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Extreme Store versions = 1.5.7...

[SECURITY] Fedora 42 Update: rust-app-store-connect-0.5.0-6.fc42

Apple App Store Connect API and client...

Microsoft Windows Notepad < 11.2510 Command Injection (February 2026)

The Windows 'Microsoft Windows Notepad' app installed on the remote host is prior to version 11.2510. It is, therefore, affected by a command injection vulnerability: - Improper neutralization of special elements used in a command allows an unauthorized attacker to execute code over a network...

February 10, 2026—KB5075912 (OS Builds 19045.6937 and 19044.6937)

None None...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: json-exporter-fips, kubeflow-pipelines, percona-xtradb-cluster-operator, kubernetes-csi-driver-nfs, prometheus-fips, kserve-modelmesh-serving, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront-fips, kubernetes-csi-livenessprobe-fips,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: json-exporter-fips, kubeflow-pipelines, kubernetes-csi-driver-nfs, prometheus-fips, kserve-modelmesh-serving, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront-fips, kubernetes-csi-livenessprobe-fips, nfs-subdir-external-provisioner,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: json-exporter-fips, kubeflow-pipelines, percona-xtradb-cluster-operator, kubernetes-csi-driver-nfs, prometheus-fips, kserve-modelmesh-serving, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront-fips, kubernetes-csi-livenessprobe-fips,...