EUVD-2026-75934

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the miplwcuploadfile function in all versions up to, and including, 1.2.1. This makes it possible for...

CVE-2026-8778

The MIPL Grouped Checkout Fields for WooCommerce WordPress plugin is vulnerable to an unauthenticated arbitrary file upload caused by missing file type validation in the mipl_wc_upload_file function. The flaw affects all versions up to and including 1.2.2 (noted as 1.2.1 in the CVE record), allow...

CVE-2026-8778: Unrestricted Upload of File with Dangerous Type

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the miplwcuploadfile function in all versions up to, and including, 1.2.1. This makes it possible for...

CVE-2026-89262: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...

PT-2026-89761

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mipl wc upload file function in all versions up to, and including, 1.2.1. This makes it possible for...

CVE-2026-88051 Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and sizeused from a .traineddata model without a cap or an invariant check. reservereserved allocates the backin...

CVE-2026-81789

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...

n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

Impact The OAuth Dynamic Client Registration endpoints validated field sizes only for redirecturis, leaving clientname and granttypes bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database...

CVE-2026-81789

Advanced Product Fields Extended for WooCommerce WordPress plugin, versions ≤ 3.1.6 , is affected by an unauthenticated arbitrary file deletion vulnerability. The CVSS 3.1 score is 8.6 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating a network-exploitable issue requiring no...

CVE-2026-81789 WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...

EUVD-2026-75522

Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce = 3.1.6 versions...

CVE-2026-81789 WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...

CVE-2026-45747 Suricata lua/tls: null dereference in TlsGetCertInfo

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic...

CVE-2026-45747 Suricata lua/tls: null dereference in TlsGetCertInfo

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic...

CVE-2026-45747

Suricata versions prior to 7.0.16 are affected by a null pointer dereference in the Lua TLS certificate information helper (TlsGetCertInfo). When a Lua script requests certificate details for TLS traffic where some fields are absent, Suricata can be crashed, resulting in a denial of service . The...

EUVD-2026-75509

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic...

CVE-2026-88868

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser...

CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. The function API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API...

CVE-2026-88875 AVideo Incomplete API Sanitization Information Disclosure

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...