bugbug (>=0.0.148, <=0.0.185), label-studio (0.4.1) potentially affected by CVE-2025-67221 via orjson (2.1.3)

orjson PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.148, =0.0.185 - label-studio 0.4.1 Source cves: CVE-2025-67221 Source advisory: OSV:GHSA-HX9Q-6W63-J58V...

bugbug (>=0.0.148, <=0.0.185), label-studio (0.4.1) potentially affected by CVE-2025-67221 via orjson (2.1.3)

orjson PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on orjson and may be impacted: - bugbug =0.0.148, =0.0.185 - label-studio 0.4.1 Source cves: CVE-2025-67221 Source advisory: OSV:PYSEC-2026-107...

CVE-2025-69051

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through = 1.7...

Copilot Studio Information Disclosure Vulnerability

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector...

Stored Cross-Site Scripting (XSS)

labelstudio is vulnerable to stored cross-site scripting XSS.The vulnerability is due to insufficient sanitization of user-controlled input in the customhotkeys functionality, which allows an authenticated attacker or one who tricks a user/admin to inject malicious JavaScript that executes in oth...

CVE-2026-0920

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajaxregisterhandle' function not restricting what user roles a user can register with. This makes it possible for...

CVE-2026-0920

CVE-2026-0920 affects the WordPress plugin “LA-Studio Element Kit for Elementor” (≤ 1.5.6.3). The root cause is a missing role restriction in the AJAX registration handler (ajax_register_handle), which lets unauthenticated users supply the lakit_bkrole parameter and create an administrator accoun...

CVE-2026-21520: Improper Neutralization of Special Elements used in a Command

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector...

CVE-2026-0920: Improper Privilege Management

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajaxregisterhandle' function not restricting what user roles a user can register with. This makes it possible for...

Microsoft Copilot Studio command injection vulnerability

Microsoft Copilot Studio is an artificial intelligence chatbot developed by Microsoft Corporation. Microsoft Copilot Studio has a command injection vulnerability, which stems from improper neutralization of certain elements. Attackers can exploit this vulnerability to access sensitive information...

PT-2026-3919

Name of the Vulnerable Software and Affected Versions LA-Studio Element Kit for Elementor versions through 1.5.6.3 Description The LA-Studio Element Kit for Elementor plugin for WordPress is susceptible to unauthorized administrative user creation. This occurs because the ajax register handle...

PT-2026-4139

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through = 1.7...

WordPress plugin LA-Studio Element Kit for Elementor has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

KLA90854 Multiple vulnerability in Microsoft Office

Multiple vulnerability was found in Microsoft Office. Malicious users can exploit this vulnerability to obtain sensitive information, bypass security restrictions. Original advisories CVE-2026-21520 Exploitation Related products Microsoft-Copilot-Studio CVE list CVE-2026-21520 critical Solution...

PT-2026-4307

Name of the Vulnerable Software and Affected Versions Microsoft Copilot Studio versions prior to January 15, 2026 Description An issue in Microsoft Copilot Studio allows an unauthenticated remote attacker to view sensitive information via a network attack vector. The flaw is rooted in a lack of...

NVIDIA CUDA Toolkit < 13.1 Multiple Vulnerabilities

The version of NVIDIA CUDA Toolkit installed on the remote host is prior to 13.1. It is, therefore, affected by multiple vulnerabilities, including the following: - NVIDIA Nsight Systems contains a vulnerability in the gfxhotspot recipe, where an attacker could cause an OS command injection by...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter vulnerability

Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakitbkrole parameter vulnerability discovered by WordFence in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.5.6.3...

20,000 WordPress Sites Affected by Backdoor Vulnerability in LA-Studio Element Kit for Elementor WordPress Plugin

On January 12th, 2026, we received a submission for a Backdoor vulnerability in the LA-Studio Element Kit for Elementor, a WordPress plugin with more than 20,000+ active installations. This vulnerability makes it possible for an unauthenticated attacker to create malicious administrator users...

CVE-2025-41081

Reflected Cross-Site Scripting XSS vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL with '/.php/'. This vulnerability can be exploited to steal sensitive user data, such as session...

VulnCheck KEV: CVE-2026-0920

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajaxregisterhandle' function not restricting what user roles a user can register with. This makes it possible for...