libbpf:bpf-object-fuzzer: Crash in bpf_object_post_load_cleanup

Detailed Report: https://oss-fuzz.com/testcase?key=4726053129224192 Project: libbpf Fuzzing Engine: libFuzzer Fuzz Target: bpf-object-fuzzer Job Type: libfuzzermsanlibbpf Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xffffafffc0da9188 Crash State: bpfobjectpostloadcleanup...

ogre:ogre_deep_fuzz: Heap-buffer-overflow in Ogre::MeshSerializerImpl::flipEndian

Project: https://github.com/OGRECave/ogre.git Detailed Report: https://oss-fuzz.com/testcase?key=4541267085426688 Project: ogre Fuzzing Engine: afl Fuzz Target: ogredeepfuzz Job Type: aflasanogre Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7cbb04fef550 Crash State:...

New WordPress Malware Uses Steam Profile Comments to Hide C2 Instructions

GoDaddy researchers found WordPress malware using Steam Community profile comments to hide encoded command and control data, with nearly 1,980 sites affected...

PT-2026-45712

Name of the Vulnerable Software and Affected Versions Tectite Forms versions prior to 1.4 Description The Tectite Forms plugin for WordPress is subject to Cross-Site Request Forgery due to missing or incorrect nonce validation in the admin init function. A nonce is a unique token used to verify...

PT-2026-45730

Name of the Vulnerable Software and Affected Versions Axiomthemes Crafti versions prior to 1.13 Description Improper control of filename for include/require statements in PHP programs allows for Local File Inclusion. This occurs when the application fails to properly validate the file paths used ...

CVE-2026-26847

Summary: PT-2026-45765 documents a critical vulnerability chain in the Collibra Platform Agent (CP/CPSH): improper authentication allows access to unauthenticated REST endpoints, then path traversal via a crafted ZIP upload leads to arbitrary file write and remote code execution on the host. Expo...

PT-2026-45700

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'a' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

PT-2026-45707

Name of the Vulnerable Software and Affected Versions Easy Cart versions prior to 1.9 Description The Easy Cart plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This occu...

PT-2026-45878

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4-rc1 Description LibreChat is an enhanced ChatGPT clone supporting multiple AI providers. The Model Context Protocol MCP server integration improperly resolves $VAR placeholders against the server's process.env...

PT-2026-45822

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 151.0.3 Description A memory boundary bug exists in the Graphics: Text component during text rendering. This issue allows sensitive browser memory to be exposed without requiring user interaction. Recommendations Upda...

PT-2026-45788

Name of the Vulnerable Software and Affected Versions Appsmith versions prior to 2.1 Description The SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them using innerHTML. This allows an authenticated Developer with access to a shared PostgreS...

PT-2026-45706

Name of the Vulnerable Software and Affected Versions BirdSeed versions prior to 2.2.1 Description The BirdSeed plugin for WordPress is subject to Cross-Site Request Forgery. This occurs because the birdseed plugin settings page function fails to perform nonce validation—a security mechanism used...

PT-2026-45693

Name of the Vulnerable Software and Affected Versions Kirki versions 6.0.0 through 6.0.6 Description The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress contains a flaw allowing unauthenticated privilege escalation and account takeover. The issue occurs because th...

Unbreakable Enterprise kernel security update

6.12.0-203.76.7.1 - smb: client: reject userspace cifs.spnego descriptions Asim Viladi Oglu Manizada Orabug: 39474418 6.12.0-203.76.7 - tun: free page on buildskb failure in tunxdpone Weiming Shi Orabug: 39456024 - tap: free page on error paths in tapgetuserxdp Weiming Shi Orabug: 39456024 - tun:...

PT-2026-45711

Name of the Vulnerable Software and Affected Versions JTL-Connector for WooCommerce versions prior to 2.4.2 Description The plugin contains missing authorization due to a lack of capability checks and nonce verification. This allows authenticated attackers with Subscriber-level access or higher t...

PT-2026-45758

Name of the Vulnerable Software and Affected Versions Elementor Website Builder versions prior to 4.1.0 Description A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to a version later than 4.1.0...

PT-2026-45823

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 151.0.3 Description A JIT miscompilation issue exists in the JavaScript Engine's JIT component, where JIT refers to Just-In-Time compilation, a method of improving program execution speed by compiling code during...

PT-2026-46410

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An out-of-bounds read and write issue exists in the ANGLE graphics engine. This flaw allows a remote attacker to potentially perform a sandbox escape and execute code on the operating...

PT-2026-45702

The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'fpw fs get file' AJAX action in all versions up to, and including, 1.9.5. This is due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-45765

A critical chain of vulnerabilities in the Collibra Platform Agent, including CVE-2026-26847 improper authentication and path traversal, allows remote, unauthenticated attackers to achieve Remote Code Execution RCE. Technical Breakdown: Vulnerability Chain: Attackers can exploit improperly...