CVE-2026-25352

CVE-2026-25352 is a confirmed Reflected XSS in the WordPress theme MyDecor. Affected products: MyDecor versions prior to 1.5.9. The entry documents a reflected cross-site scripting flaw arising from improper input neutralization during web page generation, enabling a reflected payload to execute ...

CVE-2026-25033

CVE-2026-25033 is a Reflected XSS in Motta Addons (WordPress plugin). Public details show an input handling flaw in Motta Addons versions older than 1.6.1, leading to untrusted input being reflected in generated web pages. The vulnerability note indicates impact on confidentiality, integrity, and...

CVE-2026-25032 WordPress Ricky theme < 2.31 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in parkofideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through 2.31...

CVE-2026-25033 WordPress Motta Addons plugin < 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in uixthemes Motta Addons motta-addons allows Reflected XSS.This issue affects Motta Addons: from n/a through 1.6.1...

CVE-2026-24989 WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through 11.4.0...

CVE-2026-23973

CVE-2026-23973 affects uxper Golo WordPress theme versions prior to 1.7.5. The issue is a Reflected XSS caused by improper neutralization of input during web page generation. Several connected sources corroborate the vulnerability in Golo

SUSE CVE-2026-4689

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

SUSE CVE-2026-4691

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

SUSE CVE-2026-4692

Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

SUSE CVE-2026-4699

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

SUSE CVE-2026-4705

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

SUSE CVE-2026-4715

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

SUSE CVE-2026-4720

Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in...

SUSE CVE-2026-4722

Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...

SUSE CVE-2026-4723

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...

PT-2026-28023

Name of the Vulnerable Software and Affected Versions Gracey versions prior to 1.4 Description An issue exists in Gracey that allows for object injection due to deserialization of untrusted data. This impacts the application's ability to securely handle incoming data, potentially leading to...

PT-2026-28024

Name of the Vulnerable Software and Affected Versions Kamperen versions prior to 1.3 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. Recommendations At the moment, there is no information about a newer version that contains a f...

PT-2026-28020

Name of the Vulnerable Software and Affected Versions Archicon versions prior to 1.7 Description A flaw exists in Archicon that allows for object injection due to deserialization of untrusted data. This issue impacts the software's ability to securely handle data, potentially leading to...

PT-2026-28061

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in icopydoc YML for Yandex Market yml-for-yandex-market allows Path Traversal.This issue affects YML for Yandex Market: from n/a through 5.3.0...

Linux Distros Unpatched Vulnerability : CVE-2026-4699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9,...