PT-2026-95734

Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions prior to 2.4.13 Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions or higher to perform Stored Cross-Site...

CVE-2026-12042: Improper Neutralization of Input During Web Page Generation

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

WordPress WP2Social Auto Publish plugin <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'pages' Parameter vulnerability discovered by Luca Jungnickel in WordPress Plugin WP2Social Auto Publish versions = 2.4.12...

CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-40538

Synology DiskStation Manager (DSM) is affected by an improper restriction of excessive authentication attempts in the Auto block feature. Versions prior to 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 allow remote attackers to read limited files via brute-force attacks. The CVSS 3.1 score i...

EUVD-2026-82796

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-12106

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

EUVD-2026-82730

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106 Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106 Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106

The Auto Upload Images plugin for WordPress (all versions up to and including 3.3.2 ) is vulnerable to a Limited Server-Side Request Forgery (SSRF) via the downloadImage function. The root cause is the use of wp_remote_get() instead of wp_safe_remote_get(), combined with a validate() method that ...

CVE-2026-40538: Improper Restriction of Excessive Authentication Attempts

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-12106: Server-Side Request Forgery (SSRF)

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

PT-2026-95266

Name of the Vulnerable Software and Affected Versions Auto Upload Images versions prior to 3.3.3 Description This issue is a Limited Server-Side Request Forgery SSRF, a flaw that allows a server to be coerced into making requests to an unintended location. Authenticated attackers with...

PT-2026-95326

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper restriction of excessive...

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

Five independent defects in djust's template auto-escaping cause attacker-controlled input to be rendered as live markup where Django escapes it. All four are present in shipped 1.1.0 and are fixed in 1.1.1. They share one shape: a filter or grant that escapes nothing itself and relies on the...

CVE-2026-54618

Obsidian Web MCP , a remote MCP server for Obsidian vaults, contained an authentication bypass prior to version 0.2.0. The /oauth/authorize endpoint issued an authorization code without any login, consent, or session check, and /oauth/token allowed exchanging that code for the static VAULT_MCP_TO...

CVE-2026-90139

In the Linux kernel, the following vulnerability has been resolved: fuse: check for NULL root inode in fusefillsupersubmount fuseiget can return NULL when its inode allocation fails, but fusefillsupersubmount passed the result straight to getfuseinode and decremented fi-nlookup without checking i...