WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'lsddisplstyle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Listdom versions = 5.8.1...

SUSE CVE-2026-72253

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies o...

SUSE CVE-2026-82343

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack...

WordPress Shopping Cart & eCommerce Store plugin <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'productorder' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP EasyCart versions = 5.9.2...

CVE-2026-75132

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

CVE-2026-75133

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

WordPress Photo Gallery by Ays plugin <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 's' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Photo Gallery by Ays versions = 6.8.2...

WordPress Cozy Blocks plugin <= 2.2.17 - Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter vulnerability

Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Cozy Blocks versions = 2.2.17...

SUSE-SU-2026:23411-1 Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen

This update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen fixes the following issues: Changes in MozillaFirefox: Firefox Extended Support Release 153.1.0 ESR. Fixed: Various security fixes. MFSA 2026-77 bsc1274867: CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL...

WordPress LearnPress plugin <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin LearnPress versions = 4.4.4...

OPENSUSE-SU-2026:21713-1 Security update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen

This update for MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen fixes the following issues: Changes in MozillaFirefox: Firefox Extended Support Release 153.1.0 ESR. Fixed: Various security fixes. MFSA 2026-77 bsc1274867: CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL...

CVE-2026-75133

The Keep Backup Daily WordPress plugin (versions before 2.1.4 ) contains a sensitive information exposure vulnerability in the kbd_cron_process parameter. The parameter is publicly accessible without authentication, allowing an unauthenticated attacker over the network to trigger a full MySQL dat...

EUVD-2026-68608

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-75133 Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-75133 Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

UBUNTU-CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

CVE-2026-75132

WAPT Server versions 2.6.1.17834 and earlier contain a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT, allowing them to...

CVE-2026-75132 WAPT Server SQL Injection via /api/v3/hosts Endpoint

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...