CVE-2026-86427 LibreNMS before 26.8.0 Argument Injection via graph_title

LibreNMS before 26.8.0 contains an argument injection vulnerability in the graphtitle parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized...

CVE-2026-86427 LibreNMS before 26.8.0 Argument Injection via graph_title

LibreNMS before 26.8.0 contains an argument injection vulnerability in the graphtitle parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to multiple Node.js modules fast-uri, postcss, axios, jsonata and body-parser...

CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-4945

The Otter Blocks plugin for WordPress (Gutenberg Blocks, Page Builder & FSE) is vulnerable to Insecure Direct Object Reference (IDOR) in the watch_checkout function across all versions up to and including 3.1.7 . The root cause is missing validation on a user-controlled key, allowing unauthentica...

EUVD-2026-72367

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-6431

CVE-2026-6431 affects the User Profile Builder WordPress plugin (all versions up to and including 3.15.7 ), which is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) through the 'Biographical Info' meta field parameter. The root cause is insufficient input sanitization and output e...

CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

EUVD-2026-72366

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

CVE-2026-4945 Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watchcheckout' function due to missing validation on a user controlled key. This makes it possib...

Vulnerabilities in GeoNetwork are addressed through OpenGeo

OpenGeo has identified several vulnerabilities in GeoNetwork, a open-source cataloging application, specifically in versions 4.4.5 through 4.4.11, as well as versions preceding 4.4.12 and 4.2.17. The first vulnerability involves a reflected cross-site scripting XSS attack in the public,...

Security Bulletin: Multiple vulnerabilities affect IBM Db2 Warehouse container images.

Summary IBM has released the below fix for IBM Db2® on Db2 Warehouse container images in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-35701 DESCRIPTION: Improper...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

wp2shell-poc

wp2shell-poc Independent proof-of-concept for the unauthentic...

WordPress Unlimited Elements For Elementor plugin <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter vulnerability

Reflected Cross-Site Scripting via 'formDataid' Parameter vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.17...

BIT-ELASTICSEARCH-2024-23444 Elasticsearch elasticsearch-certutil csr fails to encrypt private key

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command...

WordPress Beaver Builder Plugin (Pro Version) plugin <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter vulnerability

Reflected Cross-Site Scripting via 'noresultsmessage' nodepreview Parameter vulnerability discovered by Austin Ginder - Anchor Hosting in WordPress Plugin Beaver Builder Plugin Starter Version versions = 2.11.0.1...

WordPress WP Fusion (Pro) plugin <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability discovered by Jarno Vos jarnovos in WordPress Plugin WP Fusion Pro versions = 3.47.13...

WordPress HivePress Authentication plugin <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator vulnerability

Unauthenticated Authentication Bypass via 'accesstoken' Parameter to Facebook Authenticator vulnerability discovered by Mutantgun in WordPress Plugin HivePress Authentication versions = 1.1.4...