WordPress AI Copilot – Content Generator plugin <= 1.5.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AIWU versions = 1.5.4...

PT-2026-64261

Name of the Vulnerable Software and Affected Versions Apache OpenNLP versions prior to 2.5.10 Apache OpenNLP versions prior to 3.0.0-M5 Description Three code paths allow arbitrary class instantiation by loading a class via its fully-qualified name using Class.forName and invoking its no-arg...

PT-2026-76675

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.29.1 Kiota versions prior to 1.34.0 Description Kiota is an OpenAPI based HTTP Client code generator. An attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that...

CVE-2026-15653: Improper Neutralization of Input During Web Page Generation

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible fo...

EUVD-2026-48399

A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated...

MAL-2026-11033 Malicious code in eth-codergen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dda2a0fbfa98304482ef90da4f137c863775959e107fccd495311fcba4fd185c The package is advertised as an Ethereum ABI code generator but its index.js is a verbatim copy of the unrelated mongoose-lean-hooks plugin. Appended...

EUVD-2026-47902

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-15404 Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-15404 Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-13009: Improper Neutralization of Special Elements used in an SQL Command

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-64798

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy...

WordPress Bulk Page Generator – LPagery plugin <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Bulk Landing Page Creator for WordPress LPagery versions = 2.5.7...

DEBIAN-CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

Exploit for CVE-2026-14266

CVE-2026-14266: 7-Zip XZ Heap Buffer Overflow PoC Generator P...

PT-2026-63509

Name of the Vulnerable Software and Affected Versions Joomla Extension - regularlabs.com - IP login extension affected versions not specified Description The IP login extension generates persistent URL login keys using a non-cryptographic random generator with insufficient entropy, which can lead...

PT-2026-63784

Name of the Vulnerable Software and Affected Versions AI Copilot – Content Generator versions prior to 1.5.5 Description This issue is a generic SQL Injection occurring due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated...

CVE-2026-47398

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj added the PRAISONAIALLOWLOCALTOOLS env-var gate to the tooloverride.py sinks. However, two additional spec.loader.execmodule call sites in praisonai/agentsgenerator.py were...