CVE-2026-103688 Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that...

CVE-2026-103688

The Checkout Files Upload for WooCommerce WordPress plugin (versions before 2.4.0 ) is vulnerable to an unauthenticated arbitrary file upload vulnerability. The root cause is a lack of file type validation when the "accepted file types" setting is left empty, which is the documented method for al...

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerabilities are listed...

CVE-2026-104383

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection...

CVE-2023-26035

POC for CVE-2023-26035 Works for ZoneMinder Versions prior to 1.36.33 and 1.37.33 Vulnerability : Remote Code Execution RCE Usage └─➜ python3 poc.py -h usage: poc.py -h --target TARGET --cmd CMD poc.py: error: the following arguments are required: --target, --cmd Curl Before jumping to rev shell,...

EUVD-2026-111587

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection...

CVE-2026-104383

The EagleCloud Aquila on-premises version (versions through 2.6.7.2 ) contains a code injection vulnerability in the Pigeon MFA service . This flaw, identified as CWE-94 , occurs due to the Improper Control of Generation of Code , which allows authenticated remote attackers to execute arbitrary c...

CVE-2026-104383 Code injection in EagleCloud Aquila on-premises version

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection...

CVE-2026-1928

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

CVE-2026-111255

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

Exploit for CVE-2026-116692

mlflow-scorer-scanner Detection-only triage scanner for ML...

CVE-2021-42013

CVE-2021-42013 Vulnerable service Installation Several options: 1. Docker container docker run -d -p 8080:80 12345qwert123456/apache2450cve-2021-42013 2. Dockerfile git clone https://github.com/12345qwert123456/CVE-2021-42013.git cd CVE-2021-42013-Vulnerable-service/2.4.50 docker build -t...

CVE-2026-1928 Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

CVE-2026-1928

The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 1.0.276 . The flaw exists due to the deserialization of untrusted input within the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can injec...

EUVD-2026-111576

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

CVE-2026-111255 affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

CVE-2026-111255

The affiliate-toolkit plugin for WordPress (versions up to and including 3.9.2 ) is vulnerable to Arbitrary File Upload via the upload_image function. The root cause is insufficient file type validation, specifically a weak Content-Type prefix check combined with extension derivation from an atta...

CVE-2026-111255 affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

EUVD-2026-111574

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice

A flaw was found in the Linux kernel's smcrxsplice function within the net: smc component. This vulnerability arises from an imbalance in the lifetime management of splice entries, where page references are not properly handled before being passed to splicetopipe. This can lead to a reference cou...