CVE-2026-97309 WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...

CVE-2026-97283 WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5...

CVE-2026-97275 WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0....

CVE-2026-97309

The RepairBuddy computer-repair-shop WordPress plugin, developed by Webful Creations , is vulnerable to a Missing Authorization flaw in versions up to and including 4.1226 . This vulnerability allows an attacker to Retrieve Embedded Sensitive Data from the application. While the technical root ca...

EUVD-2026-92588

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...

CVE-2026-97309 WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...

CVE-2026-103334

The Five Star Restaurant Reservations WordPress plugin (versions

CVE-2026-105628 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that...

CVE-2026-105628 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that...

CVE-2026-105628 Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that...

CVE-2026-105628

The open-source project management tool Plane is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The flaw exists in the OAuth avatar synchronization flow, where the application fetches an avatar_url from provider user data via a server-side HTTP request. Because the ...

CVE-2026-93319 A malicious frontend can cause a daemon panic

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2026-93319

The BuildKit daemon is vulnerable to a data race condition when a malicious external BuildKit frontend sends requests using the internal API. This vulnerability (classified as CWE-567 ) can lead to a panic of the BuildKit daemon, impacting availability. Remediation information is provided in the ...

CVE-2026-93319 A malicious frontend can cause a daemon panic

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

EUVD-2026-92534

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2026-93319 A malicious frontend can cause a daemon panic

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

GHSA-3CM4-CCVW-6XR6 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...

CVE-2026-104968

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/entity-search/?querytype=usermention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The...

CVE-2026-104967 Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

CVE-2026-59787

A flaw was found in Zabbix. The Perl Simple Network Management Protocol SNMP trap receiver script does not properly sanitize the record delimiter within incoming trap content. An attacker capable of sending SNMP traps can exploit this vulnerability to inject forged trap records targeting other...