CVE-2026-27422

Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2...

praisonai: recipe serve auth middleware silently disables itself when no secret is set

praisonai: recipe serve authentication middleware silently disables itself when no secret is setResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAI---Package: praisonai on PyPIVersion tested: 4.6.48.File:...

EUVD-2026-48140

Unauthenticated Cross Site Request Forgery CSRF in Kwayy HTML Sitemap = 4.0 versions...

CVE-2026-65505

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65503 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65503 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

EUVD-2026-48107

Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...

CVE-2026-65494 WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability

Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65494

Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...

EUVD-2026-48103

Unauthenticated Cross Site Scripting XSS in Dokan Pro = 5.0.0 versions...

CVE-2026-65492 WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7...

EUVD-2026-48224

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

CVE-2026-59514 WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Buddyboss Platform = 3.0.5 versions...

EUVD-2026-48157

Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...

End-to-End Encryption and “Going Dark”

New paper: "Encryption and Globalization 15 Years Later: End-to-End Encryption and the Third Round of the 'Going Dark' Debate": Abstract : This Article updates and expands on 2012 research on encryption and globalization, analyzing what the authors call "Round 3" of the Going Dark Debate: the...

RHSA-2026:43825 Red Hat Security Advisory: kpatch-patch-5_14_0-687_10_1 security update

Bulletin has no description...

RHSA-2026:41898 Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Bulletin has no description...

RHSA-2026:41897 Red Hat Security Advisory: .NET 10.0 security, bug fix, and enhancement update

Bulletin has no description...

EUVD-2026-47900

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

EUVD-2026-47918

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...