CVE-2024-50510

CVE-2024-50510 AR For Woocommerce = 6.2 - Unauthenticated Arbitrary File Upload Description The AR for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 6.2. This makes it possible for unauthenticated...

CVE-2026-94370

A flaw was found in Qt for MCUs. When an application processes text through the Qt Quick Ultralite string interface, memory references are copied without transferring ownership. This condition causes the application to improperly release or reuse memory, leading to heap memory corruption. An...

RLSA-2026:80825 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

RLSA-2026:82015 Important: xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fixes: xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

RLSA-2026:82013 Important: libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...

pcre2 security update

An update is available for pcre2. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The pcre2 package contains a new generation of the Perl Compatible Regular...

xorg-x11-server security update

An update is available for xorg-x11-server. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list X.Org is an open-source implementation of the X Window System. It...

dovecot security update

An update is available for dovecot. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Dovecot is an IMAP server for Linux and other UNIX-like systems, written...

RLSA-2026:81613 Important: pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular...

pcre2 security update

An update is available for pcre2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The pcre2 package contains a new generation of the Perl Compatible Regular...

CVE-2025-65964

n8n Git Hooks CTF Demo ⚠️ This repository is for educational and CTF demonstration purposes only. Scenario An automation platform e.g., n8n uses Git operations as part of a workflow. The workflow allows arbitrary Git configuration via git config. An attacker-controlled workflow sets:...

WordPress SellKit plugin < 2.8.0 - Unauthenticated Arbitrary Price Manipulation vulnerability

Unauthenticated Arbitrary Price Manipulation vulnerability discovered by Lê Gia Khôi in WordPress Plugin SellKit versions 2.8.0...

CVE-2026-92426 YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

CVE-2026-94254 SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing...

CVE-2026-94254

The SellKit WordPress plugin (versions before 2.8.0 ) is vulnerable to unauthenticated arbitrary price manipulation . The flaw occurs because the plugin fails to validate client-supplied product prices during checkout total recalculations. An unauthenticated attacker can exploit this by using the...

EUVD-2026-100865

The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing...

CVE-2026-91076

The Robokassa payment for WooCommerce WordPress plugin (versions before 1.9.0 ) is vulnerable to an unauthenticated status change due to a lack of authenticity verification on incoming payment-notification requests. An attacker can exploit this to force any WooCommerce order into a failed state ....

EUVD-2026-100864

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin < 4.7.14 - Subscriber+ Arbitrary Album Media Injection vulnerability

Subscriber+ Arbitrary Album Media Injection vulnerability discovered by Lawal Qasim in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions 4.7.14...

CVE-2026-89288

The Fast Courier WordPress plugin (versions 5.0.0-5.2.3 ) is vulnerable to SQL injection because it fails to sanitize and escape a value used in a SQL query on an unauthenticated REST route . Specifically, the vulnerability is triggered via the 'wp_order_id' parameter. An unauthenticated attacker...