CVE-2026-14939

The Visualizer WordPress plugin is affected: versions before 4.0.6 expose a vulnerability where an attacker with Contributor-level access can supply a URL that is not validated to safe address ranges, enabling server-side requests (SSRF) to link-local instance-metadata endpoints. The fetched resp...

CLEANSTART-2026-NF04664 Security fixes in helm-fips 4.0.1-r0

Package helm-fips version 4.0.1-r0 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-DE38896 Security fixes in argo-workflows 4.0.0-r0

Package argo-workflows version 4.0.0-r0 fixes 1 vulnerabilities: CVE-2026-24051...

CVE-2025-65340

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php...

CVE-2026-59530

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-47667 CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

WordPress Tutor LMS Elementor Addons plugin <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor plugin Activation vulnerability

Missing Authorization to Authenticated Subscriber+ Tutor LMS and Elementor plugin Activation vulnerability discovered by ? in WordPress Plugin Tutor LMS Elementor Addons versions = 4.0.0...

CVE-2026-44722

Summary: CVE-2026-44722 affects pyzipper before 0.4.0, where a Python operator precedence bug in pyzipper/zipfile_aes.py prevented automatic selection of AE-2 during encryption. As a result, entries were written using AE-1 format, which stores the plaintext CRC32 checksum in the ZIP header and, f...

pyzipper has an encryption bypass for small files encrypted using it

ImpactA Python operator precedence bug in pyzipper/zipfileaes.py caused the AE-2 format to never be automatically selected during encryption, regardless of file size or compression type. As a result, all encrypted entries are written in AE-1 format unless AE-2 is explicitly forced by the caller...

CVE-2026-57773 WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through = 4.0...

CVE-2026-42201

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields redispassword, keydbpassword, dragonflypassword, clickhouseadminuser, clickhouseadminpassword, postgresuser, mysqluser are validated only as...

EUVD-2026-41980

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed in version 4.0.0-beta.474...

CVE-2026-34038 Coolify authenticated remote command injection leading to RCE and secret exfiltration

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command injection vulnerability in application deployment handling allows users with application write permissions to achieve remote code execution...

CVE-2026-34597

CVE-2026-34597 affects Coolify prior to 4.0.0-beta.470. The vulnerability lies in how user-supplied build parameters for the Nixpacks build pack are handled: the install_command provided by a user is directly concatenated into a shell command string executed on the deployment host during the buil...

PT-2026-53749

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471 Description Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Server and project lookups are not scoped to the current team, which allows any...

CVE-2026-10646

Zephyr's BSD-sockets getaddrinfo implementation subsys/net/lib/sockets/getaddrinfo.c passes a pointer to a stack-allocated state object struct getaddrinfostate aistate as the userdata of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set...

CVE-2026-57628

Administrator SQL Injection in WP All Import = 4.0.1 versions...

CVE-2026-56024

Cross-Site Request Forgery CSRF vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4.5.0...

CVE-2026-50268

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring encrypt:rsa:algorithm=OAEP does not enable OAEP encryption. Due to an incorrect BouncyCastle...

CVE-2026-39591

The CVE-2026-39591 entry concerns the WordPress WP-BusinessDirectory plugin up to version 4.0.0, where a Subscriber Arbitrary File Upload vulnerability is reported. Connected sources confirm the affected product and vulnerability class but do not provide exploit details or mitigation steps beyond...