PT-2026-104539

Name of the Vulnerable Software and Affected Versions WPC Estimated Delivery Date for WooCommerce versions prior to 4.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks ...

PT-2026-104512

Name of the Vulnerable Software and Affected Versions Simple Membership plugin for WordPress versions prior to 4.8.4 Description Unauthorized modification of data and sensitive information disclosure occur via the 'resend-activation' and 'email-activation' endpoints. These endpoints are dispatche...

PT-2026-104526

Name of the Vulnerable Software and Affected Versions MetForm WordPress plugin versions prior to 4.3.1 Description When the HubSpot Forms integration is enabled, the plugin fails to properly restrict access to a debug file created in the web root during every form submission. This allows...

PT-2026-104497

Name of the Vulnerable Software and Affected Versions WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons versions prior to 4.7.4 Description Unauthenticated attackers can extract sensitive customer data for any arbitrary email address on a site. This includes the customer name,...

PT-2026-104532

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor versions prior to 2.0.21 Description Insufficient sanitization and escaping of a parameter used in a SQL statement allows authenticated users to perform blind SQL injection attacks. This flaw enables the...

StegoMemory: Agentic Memory Acts As Covert Steganographic Channel

Is agentic memory robust against stealthy steganographic attacks? We carry out a large-scale red-teaming exercise to test whether agents can encode attacker-controlled strings in one session and recover them in another without triggering safety oversight. Following SHADE-Arena-style tasks, we emb...

Fedora 44 : cockpit-machines (2026-57e39fc2fa)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-57e39fc2fa advisory. Automatic update for cockpit-machines-357-1.fc44. Changelog for cockpit-machines Wed Sep 23 2026 Packit - 357-1 - Harden against local attacks from...

Linux Distros Unpatched Vulnerability : CVE-2026-47573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to...

Linux Distros Unpatched Vulnerability : CVE-2026-103629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross- origin data via a crafted HTML page. Chromium security...

Linux Distros Unpatched Vulnerability : CVE-2026-94637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of highly compressed data data amplification vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. User...

@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...

GHSA-X8MW-P69M-V3MX @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...

GHSA-2HW9-MC66-JC2Q Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as memory.copy, contains a vulnerability when a preemption via epochs or fuel is combined with altering the store's state or cancelling a computation. To prevent these operations from taking too long Wasmtime...

NPM: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

NPM: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.4...

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...

GHSA-59H8-W5Q6-MFMP Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

Summary The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts The action...

CVE-2026-82045

UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues, which builds a JPQL query with String.format and executes it via em.createQuery without parameter binding...

CVE-2026-82044

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf method exposed via GET /api/generate-pdf-report. Attacke...