EUVD-2026-87540

The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing...

WordPress MCP Server for WordPress plugin < 1.8.2 - CSRF to Administrator Account Creation vulnerability

CSRF to Administrator Account Creation vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

CVE-2026-96524 MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

PT-2026-99423

🚨 OpenCTI Authorization Flaw in Case Creation CVE-2026-76822 Critical Vulnerability Alert! OpenCTI is affected by CVE-2026-76822. 🔍 Identify Targets via ZoomEye: Search Dork: app="OpenCTI" Exposure: 1k instances identified globally. ZoomEye Search Link: 👉 https://t.co/C5U4m6Ej5b Infosec...

PT-2026-99248

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests under certain conditions. This allows an unauthenticated attacker to perform actio...

CVE-2026-100689: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

Linux Distros Unpatched Vulnerability : CVE-2026-100689

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27j...

CVE-2026-80430

A flaw was found in kitty. An attacker running a program within the terminal can create arbitrary files and directories outside the staging area in any location writable by the user. This issue occurs because the drag-and-drop staging mechanism improperly resolves symbolic links symlinks pointing...

EUVD-2026-87217

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new...

CVE-2026-56733 Zammad: Incorrect Authorization and Improper Privilege Management

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new...

CVE-2026-80430

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

DEBIAN-CVE-2026-80430

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

CVE-2026-80430

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

UBUNTU-CVE-2026-80430

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

CVE-2026-80430

The kitty terminal emulator (versions 0.47.0 before 0.49.0 ) is vulnerable to an improper link resolution flaw in its drag and drop protocol. The root cause lies in subdir_data_for_drag() within kitty/dnd.c, which constructs path strings instead of walking the tree component by component. This al...

EUVD-2026-87063

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

CVE-2026-80430

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

CVE-2026-80430 Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory

Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directory, because subdirdatafordrag in kitty/dnd.c...

BIT-GITLAB-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...