CVE-2026-48772 ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the PROXY UNKNOWN \r\n PP1 frame as a well-formed PROXY protocol header. The HAProxy PROXY protocol v1 specification says that when the protocol token is UNKNOW...

CVE-2026-48772

ProxySQL (versions 2.0.0–3.0.8) is vulnerable to a PROXY protocol v1 UNKNOWN frame bypass. The frontend accepts the PROXY UNKNOWN header and, despite the spec requiring ignoring the address fields, ProxySQL parses them via sscanf and writes a spoofed source address into the session, feeding i...

EUVD-2026-37978

The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the galleryimageupdateasfeature AJAX handler action:...

PT-2026-51100

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0 Description The logout button fails to clear the user session, allowing a previous user to remain logged in unless another user explicitly authenticates. This occurs because the '/logout' endpoint deletes...

CVE-2026-48821 Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting XSS vulnerability in the Thumbnail Synchronizer feature. When an administrator runs the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted...

EUVD-2026-37657

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

CVE-2026-22335

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

CVE-2026-22335 WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

CVE-2026-22335

The CVE CVE-2026-22335 affects WordPress: WooCommerce Frontend Manager – Ultimate (wc-frontend-manager-ultimate) versions below 6.7.7. It is a SQL Injection vulnerability exploitable by an authenticated subscriber, with a CVSS base score of 8.5 per Patchstack (high impact: confidentiality) and 6....

CVE-2026-22335 WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

CVE-2026-9570

The Taskbuilder WordPress plugin (versions before 5.0.8 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the improper sanitization of a URL parameter before it is echoed into inline JavaScript on a frontend page that contains one of the plugin's shortcode...

PT-2026-50288

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

WordPress Plugin: wc-frontend-manager-ultimate: CVE-2026-22335: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

PT-2026-50543

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting XSS vulnerability in the Thumbnail Synchronizer feature. When an administrator runs the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted...

Malicious code in utils-common-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6999f05f6036baf4f6d45de0c55c6dd63452dc59ab6ebcbad0ffebf93e60584 package.json declares a postinstall lifecycle hook that runs curl -s http://8.140.205.78 -o /dev/null on every install. The package's only functional...

Information Disclosure

Vaadin Maven Plugin and Vaadin Gradle Plugin are vulnerable to information disclosure. The vulnerability is due to the plugins logging the complete set of environment variables when the frontend build process fails with a non-zero exit status, which allows an attacker to obtain sensitive...

Important: Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image

A new satellite/iop-host-inventory-frontend-rhel9 container image is now generally available in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image

A new satellite/iop-vulnerability-frontend-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed package...

EUVD-2026-36699

The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin acces...

@lifesg/web-frontend-engine (>=2.2.4, <=2.2.5), @osdlabel/react (0.0.1) +2 more potentially affected by CVE-2026-44311 via fabric (>=7.1.0, <=7.2.0)

fabric NPM version =7.1.0, =2.2.4, =2.2.5 - @osdlabel/react 0.0.1 - @osdlabel/solid 0.0.1 - osdlabel 0.0.1 Source cves: CVE-2026-44311 Source advisory: GHSA-W22M-HVVM-XMWX...