PT-2026-34856

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render post thumbnail function, where wp kses post ...

The vulnerability of the distributed resource management system, which optimizes workloads in Siemens Altair Grid Engine data centers, stems from an uncontrolled search element that allows attackers to execute arbitrary code.

The vulnerability of the distributed resource management system, which optimizes workloads in Siemens Altair Grid Engine data centers, is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a attacker to execute arbitrary code using a specially created D...

The vulnerability of the distributed resource management system, which optimizes workloads in Siemens Altair Grid Engine data centers, is related to errors in the certificate validation process. These errors allow attackers to disclose password hashes.

The vulnerability of the distributed resource management system, which optimizes workloads in Siemens Altair Grid Engine data centers, is related to errors in the certificate validation process. Exploiting this vulnerability can allow attackers to disclose password hashes...

The vulnerability of the distributed resource management system, which optimizes workloads in Siemens Altair Grid Engine data centers, is related to an uncontrolled search element that allows attackers to execute arbitrary code with elevated privileges.

The vulnerability of the distributed resource management system, which optimizes workloads in Siemens Altair Grid Engine data centers, is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a attacker to execute arbitrary code with elevated privileges...

PT-2026-36860

Summary An integer overflow in Grid::expand rows can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal invariant is broken, the safe API get may invoke get unchecked with an invalid index, resulting in Undefined Behavior. Details Tested...

Malicious code in @bmg-web/bmg-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3145866a6b18a164c2246b0a000b18412f9f8cc10f5c4192a2a8925d213bedb1 The package @bmg-web/bmg-grid was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2988 Malicious code in @bmg-web/bmg-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3145866a6b18a164c2246b0a000b18412f9f8cc10f5c4192a2a8925d213bedb1 The package @bmg-web/bmg-grid was found to contain malicious code. Source: ossf-package-analysis...

Metasploit Wrap-Up 04/17/2026

Happy Friday - Seven New Metasploit Modules We’re happy to announce that Metasploit Framework had a big week, landing seven new modules alongside various bug fixes and enhancements. This week’s highlights include RCE modules targeting AVideo, openDCIM, Selenium Grid/Selenoid, and ChurchCRM. On th...

CVE-2026-0718 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultpshareCountcallback function in all versions up to, and including, 5.0.5. This makes it possible for...

CVE-2026-0718

The CVE-2026-0718 entry concerns the WordPress plugin Post Grid Gutenberg Blocks for News, Magazines, Blog Websites — PostX . It is affected by a missing capability check in the function ultp_shareCount_callback() , allowing unauthenticated modification of the share_count post meta for any post, ...

CVE-2026-0718 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultpshareCountcallback function in all versions up to, and including, 5.0.5. This makes it possible for...

CVE-2026-0718

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultpshareCountcallback function in all versions up to, and including, 5.0.5. This makes it possible for...

WordPress Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX plugin <= 5.0.5 - Missing Authorization to Limited Post Meta Modification vulnerability

WordPress Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX plugin = 5.0.5 - Missing Authorization to Limited Post Meta Modification vulnerability discovered by Mohammad Amin Hajian mamadrce in WordPress Plugin PostX versions = 5.0.5...

WordPress plugin Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

PT-2026-33282

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp shareCount callback function in all versions up to, and including, 5.0.5. This makes it possible for...

CVE-2026-38528

Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rottenlead parameter at /Lead/LeadDataGrid.php...

SQL Injection

Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to SQL Injection via the rottenlead parameter in the...

WordPress Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget plugin <= 3.5.6 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget versions = 3.5.6...

WordPress Post grid and filter ultimate plugin <= 1.7.4 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Post grid and filter ultimate versions = 1.7.4...

WordPress Team Slider and Team Grid Showcase plus Team Carousel plugin <= 2.8.6 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Team Slider and Team Grid Showcase plus Team Carousel versions = 2.8.6...