CVE-2026-72001 Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-72001 Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-72001

Pangolin versions prior to 1.22.0 contain an authentication bypass in the share-link endpoint. The root cause is that an attacker-controlled URL parameter can omit the expected resource identifier from the token verification call, allowing a holder of a single valid share link to authenticate aga...

CVE-2026-72001 Pangolin < 1.22.0 Authentication Bypass via Share-Link Endpoint

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

Malicious code in test__123q1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6 The package declares a postinstall hook node dist/script.js while its declared main entry dist/index.js is an inert 105-byte stub, so the entire...

MAL-2026-15637 Malicious code in test__123q1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6 The package declares a postinstall hook node dist/script.js while its declared main entry dist/index.js is an inert 105-byte stub, so the entire...

WordPress User Profile Builder plugin <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Profile Builder versions = 4.0.0...

WordPress Support Genix plugin <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability

Authenticated Subscriber+ Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Support Genix versions = 1.4.52...

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'lsddisplstyle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Listdom versions = 5.8.1...

Malicious code in spc_login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a20e34373650f3fda40b9ea351c7ccb15ae98292cd159863cb26c0c33ff8c1 package.json declares a preinstall hook "node preinstall.js || true" that runs unconditionally on npm install. preinstall.js filters process.env for...

MAL-2026-15622 Malicious code in spc_login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a20e34373650f3fda40b9ea351c7ccb15ae98292cd159863cb26c0c33ff8c1 package.json declares a preinstall hook "node preinstall.js || true" that runs unconditionally on npm install. preinstall.js filters process.env for...

SUSE CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

SUSE CVE-2026-72242

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sksocket dereference in selinuxsctpbindconnect selinuxsctpbindconnect dereferences sk-sksocket to pass a struct socket to selinuxsocketbind and selinuxsocketconnecthelper. However, when the hook is invoked from the...

SUSE CVE-2026-72243

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

SUSE CVE-2026-72253

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies o...

SUSE CVE-2026-82343

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack...

WordPress Shopping Cart & eCommerce Store plugin <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'productorder' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP EasyCart versions = 5.9.2...

CVE-2026-75132

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

CVE-2026-75133

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

WordPress Photo Gallery by Ays plugin <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 's' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Photo Gallery by Ays versions = 6.8.2...