WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.5 - Cross-Customer Subscription Cancellation vulnerability

Cross-Customer Subscription Cancellation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Full Stripe Free versions 8.5.5...

CVE-2026-80311

The Stripe Payment Forms by WP Full Pay WordPress plugin, in versions before 8.5.5 , is vulnerable to a cross-customer subscription cancellation via an Insecure Direct Object Reference (IDOR) . The plugin fails to verify if a subscription belongs to the customer associated with the active custome...

WordPress User Profile Builder plugin < 4.0.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Profile Builder versions 4.0.1...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

Web--Vulnerability-scanner

Web--Vulnerability-scanner A web vulnerability scanner i...

Linux Distros Unpatched Vulnerability : CVE-2026-82255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlle...

Freenet: Deanonymization Vulnerability

Background Freenet is an encrypted network without censorship. Description A vulnerability has been discovered in Freenet. Please review the CVE identifier referenced below for details. Impact This release fixes as an XSS vulnerability that may allow an attacker to deanonymize the user. Workaroun...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001430)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001430 advisory. In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in a tunnel When rx-udp-gro-forwarding is enabled...

Debian dla-4760 : roundcube - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4760 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4760-1 [email protected]...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ArchiveAdmin restore process. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious content into the page title field during the restore operation. Details...

EUVD-2026-68015

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

GHSA-56WQ-X3WV-3FF4 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

Summary The SeaweedFS S3 API gateway did not reject .. path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. The request URL path was hardened against traversal in 4.30 CVE-2026-54917, but the copy-source header was only checked for emptiness, so a .. segment in the...

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

Summary The SeaweedFS S3 API gateway did not reject .. path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. The request URL path was hardened against traversal in 4.30 CVE-2026-54917, but the copy-source header was only checked for emptiness, so a .. segment in the...

EUVD-2026-42285

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read...

CVE-2026-82291

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms,...

CVE-2026-76794

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report...

CVE-2026-55067

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket allows the request body projectviewid value to be mass assigned by Bucket.Update in pkg/models/kanban.go. The permission check validates that the bucket currentl...

CVE-2026-55066

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

CVE-2026-55065

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier...