EUVD-2026-51869

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials due to storing session tokens in plaintext in the operatorsessions table. An attacker can gain unauthorized access to operator sessions by obtaining a copy of the database through backup, snapshot,...

SUSE-SU-2026:2838-1 Security update for libexif

This update for libexif fixes the following issues - CVE-2026-40385: Fixed information disclosure and crashes via integer overflow in Nikon MakerNote handling bsc1262000 - CVE-2026-40386: Fixed denial of service and information disclosure via integer underflow in MakerNote decoding bsc1262001 -...

Wordfence Intelligence Weekly WordPress Vulnerability Report (June 22, 2026 to June 28, 2026)

Last week, there were 243 vulnerabilities disclosed in 195 WordPress Plugins and 9 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 131 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

CVE-2026-56227 Capgo - Server-Side Request Forgery via Webhook URL Validation

Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend performs outbound requests to these...

CVE-2026-46394

creationtimestamp| type| source ---|---|--- 2026-06-09 19:00:13+00:00| published-proof-of-concept| Telegram/Twzxtbvyqic9grgE7JaZrbs3i9BOrZG8PBBvMyWgrTB7Ya8 2026-06-09 23:00:05+00:00| published-proof-of-concept| Telegram/avQcqITCN0CdPqbuzPd1c2U29MoQRxNSjCudrYTZic4II 2026-07-12 10:00:03+00:00|...

CVE-2026-00000

creationtimestamp| type| source ---|---|--- 2026-06-09 15:00:12+00:00| published-proof-of-concept| Telegram/TPZhP3a04vI9AManDnxQiLM92frB40hJI3gtpEixtxo5IZo 2026-06-09 23:00:05+00:00| published-proof-of-concept| Telegram/avQcqITCN0CdPqbuzPd1c2U29MoQRxNSjCudrYTZic4II...

PT-2026-47173

$1,000 of compute found 21 zero-days in FFmpeg. An autonomous agent called depthfirst scanned roughly 1.5 million lines of C, then wrote a reproducible proof-of-concept for every bug it reported. The shift is that second half. Not a list of suspicious lines for a human to chase, but 21 crashing...

CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

PT-2026-46324

Unauthenticated Local File Inclusion in Rosaleen = 2.8 versions...

PT-2026-46340

Unauthenticated Local File Inclusion in Especio = 1.0 versions...

PT-2026-46368

Unauthenticated Local File Inclusion in Skyward = 1.10 versions...

PT-2026-46328

Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...

PT-2026-46362

Unauthenticated Local File Inclusion in Granola = 1.13 versions...

PT-2026-46351

Unauthenticated Local File Inclusion in Abelle = 1.22 versions...

PT-2026-46332

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme = 1.2.2 versions...

PT-2026-46374

Unauthenticated Local File Inclusion in Orpheus = 1.3 versions...

PT-2026-45932

BREAKING: Samsung discloses critical CVE-2026-23786 and CVE-2024-53922 in semiconductor products, enabling potential unauthorized access with patches pending. https://t.co/As20ekaylO...

USN-8371-1: Linux kernel vulnerabilities

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker...

Wordfence Bug Bounty Program Monthly Report – March 2026

In March 2026, the Wordfence Bug Bounty Program received 1718 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...