WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwbwgmpreviewmail' and 'mwbwgmwoocommerceaddcartitemdata' functions in all versions up to, and including, 2.6.0. This makes it possible for...

CVE-2026-17580

The CVE concerns the WordPress plugin Advanced Views (Display Custom Fields) versions up to and including 3.9.1. It exposes sensitive content via REST endpoints register_rest_routes (view-refresh and card-refresh), where an authenticated user with subscriber-level access or higher can access admi...

CVE-2026-17580 Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2025-69930

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...

CVE-2025-69930

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...

EUVD-2025-210558

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...

CVE-2025-69930

CodeAstro Membership Management System 1.0 is affected by a SQL Injection vulnerability in print_membership_card.php?id=1. The associated CVE (CVE-2025-69930) has a CVSS v3.1 base score of 9.8 (CRITICAL) with network access, low attack complexity, no privileges required, and no user interaction, ...

CVE-2026-13309

Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to...

EUVD-2026-50558

Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to...

SUSE CVE-2026-64491

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascamdisconnect cancels capturework and midiinwork before usbkillanchoredurbs kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule...

CVE-2026-64491 ALSA: usx2y: us144mkii: fix work UAF on disconnect

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascamdisconnect cancels capturework and midiinwork before usbkillanchoredurbs kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule...

CVE-2026-64480

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. The ice1712 driver calls sndctlnew1 without checking the return value before dereferencing the pointer in multiple places...

GHSA-4JWF-M4WG-8P66 Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Summary kiota plugin add / kiota plugin generate with -t APIPlugin emits an attacker-controlled statictemplate.file path from the AI-plugin extensions x-ai-adaptive-card, x-ai-capabilities verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest...

Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...

MAL-2026-10966 Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...

MAL-2026-10870 Malicious code in @atlaskit-internal_.smart-card/hover-card (npm)

--- -= Per source details. Do not edit below this line.=-...

Specter 2.0

Specter turns your Flipper Zero into a pocket counter-surveillance bug-sweep for active 13.56 MHz NFC readers - a hidden card skimmer slipped into a payment terminal, a covert reader behind a door panel, a rogue logger taped under a desk. It passively senses the RF carrier that any powered-on...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...

CVE-2026-59864 Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...