WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by hivesec in WordPress Plugin Quick Interest Slider versions = 3.1.6...

[SECURITY] [DLA 4645-1] cloud-init - correct sources.list generation

------------------------------------------------------------------------- Debian LTS Advisory DLA-4645-1 [email protected] https://www.debian.org/lts/security/ Noah Meyerhans June 24, 2026 https://wiki.debian.org/LTS -...

CVE-2026-11856

Successfully using libcurl to do a transfer to a specific HTTP origin hostA with Digest authentication and then changing the origin to a different one hostB for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Authorization: header field meant for hostA, to hostB...

WordPress URL Preview plugin <= 1.0 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Eason - The University of Sydney in WordPress Plugin URL Preview versions = 1.0...

WordPress EntreDroppers plugin <= 1.1.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin EntreDroppers versions = 1.1.2...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

EUVD-2026-38739

Capgo before 12.128.2 fails to enforce limitedtoorgs and limitedtoapps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the...

BIT-NGINX-GATEWAY-FABRIC-2026-32682 NGINX Gateway Fabric vulnerability

When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. Note:...

WordPress WP Forms Connector plugin <= 1.8 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by jamaal in WordPress Plugin WP Forms Connector versions = 1.8...

CVE-2026-8622

The Image Sizes on Demand plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHPSELF Server Variable in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-12416

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the pravelinvoicechangepassword function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and...

Malicious code in dbt-language-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15387169de77b4c18baf8c3f4d27156085bd06d96d0a27879545c3f0358dba8 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js collects installer-side reconnaissance data —...

Embedded Malicious Code

Overview html-to-gutenberg is a Transform any valid HTML string into fully editable WP Gutenberg blocks in seconds rather than hours. Affected versions of this package are vulnerable to Embedded Malicious Code. This release contains a multi-stage, blockchain-C2 remote code execution loader in...

Malicious code in html-to-gutenberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4e3b38055d924ccd5540e529660f55d9e4f49a2f76897c0903e7475fab1ffd1 The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently executes...

MAL-2026-6359 Malicious code in html-to-gutenberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4e3b38055d924ccd5540e529660f55d9e4f49a2f76897c0903e7475fab1ffd1 The package ships a.vscode/tasks.json with runOn=folderOpen, hide=true, and presentation.reveal=never that silently executes...

Flounder 0.1.0

Flounder turns modern coding agents into an end-to-end security audit system. Give it an authorized target boundary - a repository, source tree, package, deployed clue, or prior run - and the agent can prepare the workspace, read the code and supporting material, map the attack surface, dig into...

PT-2026-52101

Name of the Vulnerable Software and Affected Versions Zephyr versions 4.1.0 through 4.4.0 Description The PL011 UART driver in drivers/serial/uart pl011.c contains an unbounded software loop within the pl011 irq tx enable function. This loop repeatedly invokes the interrupt-driven application...

PT-2026-51897

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the PPPoE driver where the generic PPP layer function ppp input accepts Protocol Field Compression PFC frames, despite PFC not being recommended for PPPoE. If an...

JetBrains GoLand < 2026.1.3 RCE

The version of JetBrains GoLand installed on the remote host is prior to 2026.1.3. It is, therefore, affected by a remote code execution vulnerability: - In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration CVE-2026-53915 Note that Nessus has...

Debian dla-4645 : cloud-init - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4645 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4645-1 [email protected] https://www.debian.org/lts/security/...