NPM: Electron: shell.openPath path validation bypass via embedded null byte

NPM: Electron: shell.openPath path validation bypass via embedded null byte vulnerability discovered by ? in WordPress Npm electron versions 39.8.6...

NPM: Electron: Cross-origin iframe can position native autofill popup

NPM: Electron: Cross-origin iframe can position native autofill popup vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

NPM: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin vulnerability discovered by ? in WordPress Npm electron versions 39.8.7...

NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

NPM: Electron: Parent process code-sign check is spoofable

NPM: Electron: Parent process code-sign check is spoofable vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

WordPress WP Travel Engine plugin < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update vulnerability

Unauthenticated Trip Difficulty Level Option Update vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Travel Engine versions 6.8.2...

WordPress Responsive Thumbnail Slider plugin < 1.1.53 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Thumbnail carousel slider versions 1.1.53...

CVE-2026-58227 affecting package erlang for versions less than 26.2.5.21-3

CVE-2026-58227 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...

CVE-2026-55737 affecting package erlang for versions less than 26.2.5.21-3

CVE-2026-55737 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...

CVE-2026-55953 affecting package erlang for versions less than 26.2.5.21-3

CVE-2026-55953 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin < 5.0.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions 5.0.0...

IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 (7281628)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7281628 advisory. - IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

SummaryThe AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...

WordPress WP Ghost (Hide My WP Ghost) plugin < 7.0.05 - IP Address Spoofing vulnerability

IP Address Spoofing vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Hide My WP Ghost versions 7.0.05...

WordPress Zoner - Real Estate WordPress Theme theme < 4.2 - Real Estate WordPress Theme < 4.2 - Cross-Site Scripting vulnerability

WordPress Zoner - Real Estate WordPress Theme theme 4.2 - Real Estate WordPress Theme 4.2 - Cross-Site Scripting vulnerability discovered by R3N0 in WordPress Theme Zoner - Real Estate versions 4.2...

WordPress JS Help Desk plugin < 3.1.4 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin JS Help Desk versions 3.1.4...

WordPress FluentCart A New Era of eCommerce plugin < 1.5.3 - Unauthenticated Order PII Disclosure vulnerability

Unauthenticated Order PII Disclosure vulnerability discovered by Diogo Pinto in WordPress Plugin FluentCart versions 1.5.3...

WordPress FlxWoo plugin < 3.1.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin FlxWoo versions 3.1.1...

CVE-2026-14872 Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

NPM: fast-uri vulnerable to host confusion via backslash authority introducer

NPM: fast-uri vulnerable to host confusion via backslash authority introducer vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.4...