CVE-2026-106066

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow Mitigation Avoid raw export...

Security Bulletin:Improper Enforcement of Message Integrity in Erlang/OTP SSL: Vulnerability in tls_gen_connection Module Allows Unauthenticated Data Injection

Summary Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl tlsgenconnection module allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server...

WordPress Super Forms plugin <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter vulnerability

Unauthenticated Arbitrary Directory Deletion via 'data...filessubdir' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

CVE-2026-95605

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

CVE-2026-95534

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Object Injection. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 2.0.19...

CVE-2026-20173

A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service DoS condition. This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by...

EUVD-2026-94491

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4...

CVE-2026-95606 WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4...

CVE-2026-95606

The WordPress The Events Calendar plugin (versions ≤ 6.17.4 ) is vulnerable to a PHP Object Injection vulnerability due to the deserialization of untrusted data . This flaw allows an attacker to inject objects, potentially leading to significant impact on confidentiality, integrity, and availabil...

EUVD-2026-94490

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

CVE-2026-95605 WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

CVE-2026-95605

The Passionate Programmer Peter WP Data Access WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 5.5.82 . The root cause is the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). This vulnerability could allow an attacker to perform un...

CVE-2026-95534 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Object Injection. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 2.0.19...

EUVD-2026-94488

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Object Injection. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 2.0.19...

CVE-2026-95534

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting versions up to and including 2.0.19 , is vulnerable to a PHP Object Injection flaw. This issue stems from the deserialization of untrusted data , which could allow an attacker to execute arbitrary c...

CVE-2026-95534 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Object Injection. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 2.0.19...

CVE-2026-56096

CVE-2026-56096: Solr Query Injection & Blind Data Extraction in TYPO3 EXT:solr An architectural security vulnerability was discovered in the official TYPO3 Apache Solr extension EXT:solr / apache-solr-for-typo3/solr. The issue allows unauthenticated remote attackers to inject arbitrary Solr/Lucen...

CVE-2026-92542

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec...

DRUPAL-CONTRIB-2026-203

The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands...