PT-2026-68393

Name of the Vulnerable Software and Affected Versions PeproDev WooCommerce Receipt Uploader versions prior to 2.8.1 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if a requested attachment belongs to the order associated with the provided access token...

ALSA-2026:51105 Important: LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras CRW/CR2, NEF, RAF, DNG, and others. Security Fixes: LibRaw: LibRaw: Buffer Overflow vulnerability in image processing CVE-2026-51235 For more details about the security issues, including the impact, a CVSS score,...

AlmaLinux 10 : java-25-openjdk (ALSA-2026:42899)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42899 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance...

Malicious Package

Overview bnpl-blocks-atom-bnpl-image is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - Tech Preview Release Of the Go based Model Transparency CLI

The Tech Preview release of the Go based RHTAS Model Transparency CLI image. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The Go based RHTAS Model Transparency CLI image can be used to sign and verify AI/M...

Important: Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency 1.0.3

The GA release of the RHTAS Model Transparency CLI image. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads...

CVE-2026-18927

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

EUVD-2026-53470

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

CVE-2026-18927 imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage unrestricted upload

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

CVE-2026-18927

CVE-2026-18927 affects imranrisal-dev Student-Management-System, specifically the Shared Upload Helper’s file student_profile_pic.php function storeProfileImage. An attacker can manipulate the argument choose_file to achieve unrestricted file upload, with the attack executable remotely. The explo...

CVE-2026-70596

Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...

sunrize (>=2.1.6, <=2.1.9), x3d-image (>=3.0.23, <=3.0.26) potentially affected by CVE-2026-70606 via electron (43.0.0-beta.3)

electron NPM version 43.0.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - sunrize =2.1.6, =3.0.23, =3.0.26 Source cves: CVE-2026-70606 Source advisory: OSV:GHSA-R4W5-6PFG-JXP5...

sunrize (>=2.1.6, <=2.1.9), x3d-image (>=3.0.23, <=3.0.26) potentially affected by CVE-2026-70606 via electron (43.0.0-beta.3)

electron NPM version 43.0.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - sunrize =2.1.6, =3.0.23, =3.0.26 Source cves: CVE-2026-70606 Source advisory: SNYK:JS-ELECTRON-18563352...

sunrize (>=2.1.6, <=2.1.9), x3d-image (>=3.0.23, <=3.0.26) potentially affected by CVE-2026-70606 via electron (43.0.0-beta.3)

electron NPM version 43.0.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - sunrize =2.1.6, =3.0.23, =3.0.26 Source cves: CVE-2026-70606 Source advisory: GHSA-R4W5-6PFG-JXP5...

sunrize (>=2.1.6, <=2.1.9), x3d-image (>=3.0.23, <=3.0.26) potentially affected by CVE-2026-70606 via electron (43.0.0-beta.3)

electron NPM version 43.0.0-beta.3 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - sunrize =2.1.6, =3.0.23, =3.0.26 Source cves: CVE-2026-70606 Source advisory: MEND:CVE-2026-70606...

gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)

A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...

gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...

MAL-2026-12877 Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...

Malicious code in bnpl-blocks-atom-bnpl-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c88f06629de21bc094c8b6767cfe524db6b348eb0c7a32b4f54ef1447376f2 On require of the package, index.js loads runtime.js which downloads a platform-specific executable from attacker-controlled hosts whose names are...

Malicious code in bnpl-blocks-atom-image-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629920c8010c4cc8284a3698f4d748214d9ac784f67df8250ace5e656240ecb3 On require of the package, index.js loads setup.js which reconstructs attacker-controlled hostnames from split-string arrays...