CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

renovate-operator v6.0.1

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

CVE-2026-64961

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

EUVD-2026-63361

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-64961

ATutor (a learning management system) is vulnerable to authentication bypass in its auto-login functionality. Although a token validation check exists, the values required for token validation remain uninitialized in certain code paths , allowing an unauthenticated attacker who knows a user's ide...

CVE-2026-64961 Authentication Bypass in ATutor

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

PT-2026-79009

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration...

CVE-2026-22306 Critical flaw impacting OZOLS ERP's automatic update channel

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel...

CVE-2026-22306 Critical flaw impacting OZOLS ERP's automatic update channel

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected component: the automatic update channel...

CVE-2026-22306

CVE-2026-22306 is a CRITICAL (CVSS 10.0) vulnerability in OZOLS ERP (Ozols Grupa) on Windows, caused by an abandoned auto-update domain . The affected components include the OzolsSQL client update path , the _update SQL Server Agent job (@subsystem = N'ActiveScripting'), and serv_update.vbs . The...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-64849 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin, in versions before 4.4.8 , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape certain query-string parameters reflected on one of its admin pages. Attackers can exploit this ...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

Malicious code in solidity-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f The npm package [email protected] impersonates the popular pino logger: the README badges and lib/ source tree are copied from pino pinojs/pino, bu...

Malicious code in @sarex-team/sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...

easywall v2.7.0

easywall Your firewall. Your rules. No surprises. Live demo · Documentation · Changelog nftables through a web interface that cannot lock you out: every apply reverts itself unless you confirm it. !The easywall dashboard: firewall status with acceptance state, pending changes and last apply; tile...

PT-2026-78284

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570: Improper Neutralization of Input During Web Page Generation

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...