CVE-2026-1317 WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is due to insufficient escaping on the filename parameter which is stored in the database during file upload and later used in raw SQL queri...

CVE-2026-1317 WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is due to insufficient escaping on the filename parameter which is stored in the database during file upload and later used in raw SQL queri...

Splunk Enterprise 9.2.0 < 9.2.11, 9.3.0 < 9.3.9, 9.4.0 < 9.4.7, 10.0.0 < 10.0.2 (SVD-2026-0203)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0203 advisory. - In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster SHC...

Dell Wireless 5932e / Qualcomm Snapdragon X62 Firmware < 3.2.0.22 Code Execution (DSA-2025-363)

According to its self-reported version, the Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver installation on the remote Windows host is affected by an unquoted search path or element vulnerability. A low-privileged attacker with local access could potentially exploit...

PT-2026-20472

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.0 Splunk Enterprise versions prior to 10.0.2 Splunk Enterprise versions prior to 9.4.7 Splunk Enterprise versions prior to 9.3.9 Splunk Enterprise versions prior to 9.2.11 Description A user with access...

GrandStream GXP1600 Unauthenticated Remote Code Execution

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution RCE with root privileges on a target device. The vulnerability affects all six...

GHSA-782P-5FR5-7FJ8 OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

Summary When the Slack integration is enabled, Slack channel metadata topic/description could be incorporated into the model's system prompt. Impact Prompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadat...

WordPress Wiguard theme < 2.0.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Wiguard versions 2.0.1...

CVE-2025-32355

Rocket TRUfusion Enterprise (versions through 7.10.4.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from a misconfigured reverse proxy that handles incoming connections, allowing an attacker to specify absolute URLs within the HTTP request line. This causes the proxy ...

CVE-2026-2003 affecting package postgresql for versions less than 14.21-1

CVE-2026-2003 affecting package postgresql for versions less than 14.21-1. An upgraded version of the package is available that resolves this issue...

EUVD-2026-6081

Heap buffer overflow in libvpx. This vulnerability affects Firefox 147.0.4, Firefox ESR 140.7.1, and Firefox ESR 115.32.1...

CVE-2026-2447

A heap buffer overflow vulnerability exists in the libvpx library, which provides the VP8 SDK for encoding and decoding video codecs. This vulnerability affects multiple applications and distributions, including Firefox , Firefox ESR , and Thunderbird . The flaw was addressed in the following ver...

WordPress personal-authors-category plugin <= 0.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin personal-authors-category versions = 0.3...

CVE-2026-0929 RegistrationMagic < 6.0.7.2 - Subscriber+ Form Creation

The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site...

Mozilla Firefox < 147.0.4

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 147.0.4. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-10 advisory. - Heap buffer overflow in libvpx. This vulnerability affects Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR...

CVE-2025-69421 affecting package hvloader for versions less than 1.0.1-17

CVE-2025-69421 affecting package hvloader for versions less than 1.0.1-17. A patched version of the package is available...

CVE-2025-69420 affecting package hvloader for versions less than 1.0.1-17

CVE-2025-69420 affecting package hvloader for versions less than 1.0.1-17. A patched version of the package is available...

CVE-2026-25646 affecting package libpng for versions less than 1.6.55-1

CVE-2026-25646 affecting package libpng for versions less than 1.6.55-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-24747 affecting package pytorch for versions less than 2.0.0-13

CVE-2026-24747 affecting package pytorch for versions less than 2.0.0-13. A patched version of the package is available...

AZL-77423 CVE-2026-2004 affecting package postgresql for versions less than 16.12-1

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...