CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

WordPress MetForm plugin < 4.3.1 - Unauthenticated Form Entry Data Disclosure vulnerability

Unauthenticated Form Entry Data Disclosure vulnerability discovered by Shirshak in WordPress Plugin Metform versions 4.3.1...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin (versions before 9.2 ) is vulnerable to unauthenticated data disclosure. The root cause is the failure to use a site-specific secret when deriving the storage location for import logs within the uploads directory , combined with a lack of direct acces...

EUVD-2026-91936

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

CVE-2026-80518 WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of...

EUVD-2026-91908

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from...

CVE-2026-97337

The Simple Membership plugin for WordPress is vulnerable to unauthorized data modification and sensitive information disclosure in versions up to and including 4.8.3 . The root cause is a missing authorization check (including no nonce, capability, or ownership verification) on the resend-activat...

CVE-2026-95374

An incorrect authorization flaw was found in the Network component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/543464436...

CVE-2026-95289

An incorrect authorization flaw was found in the Scroll component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/549911100...

LiveContainer

LiveContainer Un lanceur d'applications qui exécute des applications iOS sans les installer réellement ! Projet Crowdin : | Documentation : liveconainer.github.io LiveContainer LiveContainer est un lanceur d'applications pas un émulateur ni un hyperviseur qui vous permet d'exécuter des applicatio...

EUVD-2026-91896

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-92727 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-92727 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-94539

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-94539 SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Atlassian Crowd and Crowd Data Center - Unauthenticated Remote Code Execution

Atlassian Crowd and Crowd Data Center is susceptible to a remote code execution vulnerability because the pdkinstall development plugin is incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

Exploit for CVE-2026-105030

CVE-2026-105030-poc A p...

[SECURITY] Fedora 45 Update: rarian-0.8.6-8.fc45

Rarian is a documentation meta-data library that allows access to documents, man pages and info pages. It was designed as a replacement for scrollkeeper...

[SECURITY] Fedora 45 Update: PDAL-2.10.2-5.fc45

PDAL is a BSD licensed library for translating and manipulating point cloud data of various formats. It is a library that is analogous to the GDAL raster library. PDAL is focused on reading, writing, and translating point cloud data from the ever-growing constellation of data formats. While PDAL ...