NPM: Remotion: remote code execution (RCE) vulnerability

NPM: Remotion: remote code execution RCE vulnerability discovered by ? in WordPress Npm remotion versions 4.0.410...

CVE-2026-39515

Subscriber Broken Access Control in Motors 1.4.107 versions...

CVE-2026-39527

Subscriber Arbitrary File Upload in WpStream 4.11.2 versions...

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

NPM: aws-cdk-lib: OS Command Injection in NodejsFunction Bundling vulnerability discovered by ? in WordPress Npm aws-cdk-lib versions 2.246.0...

EUVD-2026-36894

Subscriber Cross Site Scripting XSS in FV Flowplayer Video Player 7.5.51.7212 versions...

CVE-2026-49066 WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway = 6.0.0 versions...

CVE-2026-42384

CVE-2026-42384 concerns the WordPress plugin “Simply Schedule Appointments” (versions prior to 1.6.11.2). The entry documents an unauthenticated, sensitive data exposure vulnerability affecting this plugin. The vulnerability is described as exposing sensitive data without authentication, with a C...

EUVD-2026-36812

Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments 1.6.11.2 versions...

CVE-2026-40793 WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Groundhogg 4.4.1 versions...

CVE-2026-40767 WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in wpForo Forum 3.0.2 versions...

CVE-2026-40767 WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in wpForo Forum 3.0.2 versions...

CVE-2026-40743 WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Tutor LMS = 3.9.7 versions...

CVE-2026-39472 WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips 5.9.0 versions...

NPM: DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

NPM: DOMPurify: Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULTALLOWEDTAGS / DEFAULTALLOWEDATTR vulnerability discovered by ? in WordPress Npm dompurify versions 3.4.7...

PT-2026-49393

Subscriber Broken Access Control in Motors 1.4.107 versions...

PT-2026-49410

Unauthenticated SQL Injection in WPGraphQL 2.11.1 versions...

PT-2026-49378

Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips 5.9.0 versions...

CVE-2026-50263 affecting package xorg-x11-server-Xwayland for versions less than 24.1.12-1

CVE-2026-50263 affecting package xorg-x11-server-Xwayland for versions less than 24.1.12-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-5419 affecting package gnutls for versions less than 3.8.13-1

CVE-2026-5419 affecting package gnutls for versions less than 3.8.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-11332 affecting package ansible for versions less than 2.17.11-2

CVE-2026-11332 affecting package ansible for versions less than 2.17.11-2. A patched version of the package is available...