MINI-PV5F-R8VF-3VP3

Bulletin has no description...

MINI-53Q6-V476-RPGX

Bulletin has no description...

MINI-97J5-88PC-24GC

Bulletin has no description...

CVE-2026-73384

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

CVE-2026-73386

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

EUVD-2026-62389

Unauthenticated SQL Injection in Nikstore Core = 1.5 versions...

CVE-2026-73386 WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

EUVD-2026-62387

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

CVE-2026-73386

The WordPress plugin "Track Geolocation Of Users Using Contact Form 7" through version 3.0.2 exposes sensitive data to unauthenticated users over the network (CVSS 7.5 HIGH, C:H/I:N/A:N). No exploitation status or remediation details are provided in the documents. Monitor for plugin updates. Patc...

CVE-2026-73386 WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

CVE-2026-73384

Pay with Contact Form 7 is a WordPress plugin affected by an unauthenticated sensitive data exposure vulnerability in versions

CVE-2026-73384 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

EUVD-2026-62385

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

CVE-2026-73384 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

mysql: X Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

PYSEC-2026-3673 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...

PYSEC-2026-3667 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Summary Glances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead ...

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

SummaryGlances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

PYSEC-2026-3664 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Summary Glances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools kubectlget, kubectldescribe, kubectldelete that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can...