Wordfence Intelligence Weekly WordPress Vulnerability Report (April 20, 2026 to April 26, 2026)

Last week, there were 158 vulnerabilities disclosed in 123 WordPress Plugins and 27 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 69 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

GHSA-75XC-FV5M-PPRR vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

CVE-2026-7205

A vulnerability was identified in duartium papers-mcp-server 9ceb3812a6458ba7922ca24a7406f8807bc55598. Impacted is the function searchpapers of the file src/main.py. Such manipulation of the argument topic leads to path traversal. The attack may be launched remotely. The exploit is publicly...

EUVD-2024-55557

NASA Earth Observing System Data and Information System EOSDIS MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter...

Linux Distros Unpatched Vulnerability : CVE-2026-31619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: fireworks: bound device-supplied status before string array lookup The status field in an EFW response is a 32-bit value supplied by the firewire device...

Network-Service-Exploitation-Lab-VAPT-Project-

🔐 Network Service Exploitation Lab VAPT Project 📌 Overvi...

BELL-CVE-2026-31662

Bulletin has no description...

TOTOLINK A3300R hour parameter command injection vulnerability

TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R hour parameter, which originates from the cstecgi.cgi file failing to properly validate the hour parameter, and can be exploited by an attacker to execute...

CVE-2026-6878

Technical details are not publicly available in the provided documents for CVE-2026-6878. Monitor for updates as new information may be added.

CVE-2026-35231

...

CVE-2026-22017

...

GHSA-CJC8-G9W8-CHFW vulnerabilities

Vulnerabilities for packages: imagemagick...

CVE-2025-62594 vulnerabilities

Vulnerabilities for packages: imagemagick...

RockyLinux 8 : .NET 8.0 (RLSA-2026:8468)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:8468 advisory. dotnet: .NET: Security Bypass and Denial of Service Vulnerability CVE-2026-26171 dotnet: .NET: Denial of Service via stack overflow CVE-2026-32203 dotnet...

GHSA-VMW5-396H-99JH vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-QG3C-XM7Q-9C4X vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-5898 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: teleport-operator-fips, sigstore-scaffolding-fips, tkn-fips, kyverno-policy-reporter-plugins-kyverno-fips, kyverno-policy-reporter-plugins-kyverno, tflint, crossplane-fips, trivy-fips, cg, zarf, docker-cli-buildx, tekton-chains, ratify, goreleaser, skaffold-fips,...

CVE-2026-27769

creationtimestamp| type| source ---|---|--- 2026-04-15 12:30:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjjvk3msii2m 2026-04-16 11:35:10+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjmcwqgahd2b...

Use of a Broken or Risky Cryptographic Algorithm

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to the generateCTR process in G3413CTRBlockCipher. An attacker can recover relationships between...