Microsoft Defender Elevation of Privilege Vulnerability

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak "...

CVE-2026-72827

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

Malicious code in @zzzgenesis00/web3-provider-engine (npm)

Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while shipping a postinstall.js that runs automatically on npm...

WordPress Astro Booking Engine plugin <= 1.4.0 - Cross-Site Request Forgery to Settings Reset vulnerability

Cross-Site Request Forgery to Settings Reset vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Astro Booking Engine versions = 1.4.0...

GO-2026-4512 vulnerabilities

Vulnerabilities for packages: nuclei, commercial-expanso-edge...

GO-2026-4509 vulnerabilities

Vulnerabilities for packages: nuclei...

GO-2025-3764 vulnerabilities

Vulnerabilities for packages: nuclei...

GO-2025-3615 vulnerabilities

Vulnerabilities for packages: kyverno, commercial-kyverno, kyverno-fips...

GO-2025-3562 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, commercial-kyverno, kyverno-notation-aws-fips...

GO-2026-5235 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, argo-workflows, kubeflow-pipelines, kubeflow-pipelines-driver-fips, argo-workflows-fips...

GO-2026-5575 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GO-2025-3652 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

CVE-2025-10308

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

EUVD-2025-210726

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

CVE-2025-10308

The Astro Booking Engine WordPress plugin is affected by a CSRF (Cross-Site Request Forgery) vulnerability in all versions up to 1.4.0, caused by missing nonce validation on the options deletion function. This allows unauthenticated attackers to delete all plugin settings by tricking a site admin...

CVE-2025-10308 Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

CVE-2025-10308

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

PT-2026-72125

Name of the Vulnerable Software and Affected Versions Microsoft Defender affected versions not specified Description An elevation of privilege exists in the Microsoft Malware Protection Engine in Microsoft Defender, publicly referred to as "ShieldBreak". Recommendations At the moment, there is no...

CVE-2026-72823: Missing Authorization

The Grav API plugin getgrav/grav-plugin-api before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper method checks isSuperAdmin and returns early before invoking requirePermission, so the apikeyscopes cap enforced only in requirePermission is skipped. As a...

CVE-2026-69414: Improper Access Control

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak "...