Mozilla Thunderbird < 149.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-23 advisory. - Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects...

PT-2026-27420

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149 Thunderbird versions prior to 149 Description A privilege escalation issue exists in the Inter-Process Communication IPC component. This allows for potential unauthorized access and control within the system...

PT-2026-27422

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149 Thunderbird versions prior to 149 Description An undefined behavior issue exists in the Audio/Video component. This can lead to unexpected program behavior. Recommendations Update Firefox to version 149 or later...

PT-2026-27423

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149 Thunderbird versions prior to 149 Description A security issue exists due to a use-after-free condition within the Graphics: Canvas2D component. This can lead to a sandbox escape. Recommendations Update Firefox to...

PT-2026-27425

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149 Thunderbird versions prior to 149 Description A denial-of-service issue exists within the Libraries component of NSS. This flaw could potentially disrupt normal operations. Recommendations Update Firefox to versio...

PT-2026-27427

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149 Thunderbird versions prior to 149 Description Memory safety issues exist in Firefox 148 and Thunderbird 148. These bugs demonstrate evidence of memory corruption, and it is presumed that, with sufficient effort,...

WordPress Vagaro Booking Widget plugin <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code' vulnerability

Unauthenticated Stored Cross-Site Scripting via 'vagarocode' vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Vagaro Booking Widget versions = 0.3...

WordPress Text Toggle plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'title' Shortcode Attribute vulnerability discovered by Gilang - DJ in WordPress Plugin Text Toggle versions = 1.1...

WordPress The Grid plugin < 2.8.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin The Grid versions 2.8.0...

WordPress Ultimate Membership Pro plugin <= 13.7 - Account Takeover vulnerability

Account Takeover vulnerability discovered by Phat RiO in WordPress Plugin Ultimate Membership Pro versions = 13.7...

WordPress Meloo theme < 2.8.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Meloo versions 2.8.2...

WordPress YML for Yandex Market plugin < 5.3.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin YML for Yandex Market versions 5.3.0...

WordPress Halstein theme < 1.8 - Arbitrary Object Instantiation vulnerability

Arbitrary Object Instantiation vulnerability discovered by Denver Jackson in WordPress Theme Halstein versions 1.8...

WordPress Leroux theme < 1.4 - Arbitrary Object Instantiation vulnerability

Arbitrary Object Instantiation vulnerability discovered by Denver Jackson in WordPress Theme Leroux versions 1.4...

WordPress Stål theme < 1.7 - Arbitrary Object Instantiation vulnerability

Arbitrary Object Instantiation vulnerability discovered by Denver Jackson in WordPress Theme Stål versions 1.7...

WordPress Kamperen theme < 1.3 - Arbitrary Object Instantiation vulnerability

Arbitrary Object Instantiation vulnerability discovered by Denver Jackson in WordPress Theme Kamperen versions 1.3...

WordPress Tasty Daily theme < 1.27 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Tasty Daily versions 1.27...

WordPress Goldish theme < 3.47 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Goldish versions 3.47...

CVE-2026-1969

The trx_addons WordPress plugin versions prior to 2.38.5 is vulnerable to an unauthenticated arbitrary file upload vulnerability. The root cause is the improper validation of file types during specific AJAX actions , which originated from an incorrect fix for CVE-2024-13448. Exploitation allows a...

Advisory ROSA-SA-2026-3226

software: grub2 2.06 WASP: ROSA-CHROME unaffected versions = grub2-2.06-26 affected versions grub2-2.06-26 CVE-ID: CVE-2025-61662 BDU-ID: 2025-14786 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the gettext module of the Grub2 operating systems boot loader is related to the ability to use memory...