PT-2026-42059

The Sentence To SEO keywords, description and tags plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the create admin page function. This makes it possible for unauthenticated attacke...

PT-2026-42065

Name of the Vulnerable Software and Affected Versions Bottom Bar versions prior to 0.1.8 Description The Bottom Bar plugin for WordPress is susceptible to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into performing actions they did not intend to do. The issue exists ...

PT-2026-42062

Name of the Vulnerable Software and Affected Versions Sticky versions prior to 2.5.7 Description The Sticky plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the cvmh sticky front render function fails to properly sanitize input and escape output for the...

PT-2026-42084

Name of the Vulnerable Software and Affected Versions Correct Prices versions prior to 1.1 Description The Correct Prices plugin for WordPress is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation, allowing an...

PT-2026-42067

Name of the Vulnerable Software and Affected Versions Bigfishgames Syndicate versions prior to 1.3 Description The Bigfishgames Syndicate plugin for WordPress contains a Cross-Site Request Forgery CSRF flaw. This occurs because the bigfishgames syndicate submenu function lacks proper nonce...

PT-2026-42057

The 診断ジェネレータ作成プラグイン Diagnosis Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'js' parameter in versions up to and including 1.4.16. This is due to missing authorization checks and insufficient input sanitization in the themeFunc function. The function is hooke...

PT-2026-42092

Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server versions prior to r26.03 Description An authentication bypass exists in the server that could allow an attacker to gain unauthorized access. Successful exploitation may result in code execution, escalation of...

PT-2026-42180

Name of the Vulnerable Software and Affected Versions phenixdigital phoenix storybook versions 0.2.0 through 1.0.x Description An unauthenticated denial-of-service can occur via BEAM atom table exhaustion. Multiple LiveView event handlers convert user-supplied event parameter strings to atoms usi...

PT-2026-42113

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses...

PT-2026-42066

Name of the Vulnerable Software and Affected Versions Anomify AI – Anomaly Detection and Alerting plugin for WordPress versions prior to 0.3.7 Description The plugin is subject to Stored Cross-Site Scripting, a condition where malicious scripts are permanently stored on the target server. The iss...

PT-2026-42212

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.2 Splunk Enterprise versions prior to 10.0.5 Splunk Cloud Platform versions prior to 10.3.2512.8 Splunk Cloud Platform versions prior to 10.2.2510.11 Splunk Cloud Platform versions prior to 10.1.2507.21...

PT-2026-42231

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.179 Description A use after free issue in WebRTC allows a remote attacker to execute arbitrary code via a crafted HTML page. Use after free is a memory corruption flaw that occurs when an application...

PT-2026-42168

Name of the Vulnerable Software and Affected Versions Twig versions 2.16.x Twig versions 3.9.0 through 3.25.x Description A sandbox bypass exists when using a SourcePolicyInterface. This occurs because a runtime check fails to use the current template source, allowing attackers with template...

PT-2026-42193

Name of the Vulnerable Software and Affected Versions Cisco Secure Workload versions prior to 3.10.8.3 Cisco Secure Workload versions prior to 4.0.3.17 Description Insufficient validation and authentication in the internal REST API endpoints of Cisco Secure Workload allow an unauthenticated, remo...

upx:decompress_packed_file_fuzzer: Heap-buffer-overflow in N_BELE_RTP::BEPolicy::get32

Detailed Report: https://oss-fuzz.com/testcase?key=6679819541872640 Project: upx Fuzzing Engine: afl Fuzz Target: decompresspackedfilefuzzer Job Type: aflasanupx Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x79e53bbe1d9f Crash State: NBELERTP::BEPolicy::get32...

cairo:script_interpreter_fuzzer: Heap-buffer-overflow in csi_string_new

Detailed Report: https://oss-fuzz.com/testcase?key=6461277479436288 Project: cairo Fuzzing Engine: afl Fuzz Target: scriptinterpreterfuzzer Job Type: aflasancairo Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x792f1b0b2200 Crash State: csistringnew csistringdeflatenew...

freeradius:fuzzer_xlat: Use-after-poison in fr_sbuff_terminal_search

Detailed Report: https://oss-fuzz.com/testcase?key=5964617292775424 Project: freeradius Fuzzing Engine: libFuzzer Fuzz Target: fuzzerxlat Job Type: libfuzzerasanfreeradius Platform Id: linux Crash Type: Use-after-poison READ 1 Crash Address: 0x7ad3e4fe238d Crash State: frsbuffterminalsearch...

libdwarf:fuzz_showsectgrp: Heap-double-free in _dwarf_load_elf_symtab_symbols

Project: https://github.com/davea42/libdwarf-code.git Detailed Report: https://oss-fuzz.com/testcase?key=5634424300699648 Project: libdwarf Fuzzing Engine: libFuzzer Fuzz Target: fuzzshowsectgrp Job Type: libfuzzerasanlibdwarf Platform Id: linux Crash Type: Heap-double-free Crash Address:...

Malicious code in clearml-truen-patch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868fbff2db730a4a67f808b6c9bd35aa78392be592adb2d66d6be659772610f6 This package is published as clearml-truen-patch but its PKG-INFO/setup.py declare Author=ClearML, [email protected], and...

MAL-2026-4745 Malicious code in clearml-truen-patch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868fbff2db730a4a67f808b6c9bd35aa78392be592adb2d66d6be659772610f6 This package is published as clearml-truen-patch but its PKG-INFO/setup.py declare Author=ClearML, [email protected], and...