WordPress Export & Import WPBakery Page Builder plugin <= 1.0.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin Export & Import WPBakery Page Builder versions = 1.0.2...

CVE-2026-14344: Missing Authorization

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory I...

Medium: libreoffice

Issue Overview: LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a...

PT-2026-91145

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22 Description An issue exists where the software fails to enforce the board-creation permission. This allows an authenticated user without...

PT-2026-91144

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Mattermost version 10.11.22 Description An issue exists where board creation permissions are not enforced during the import of archive files. This allows an...

SUSE SLED15: libzypp / libzypp-devel / zypper / zypper-log / etc (SUSE-SU-2026:4096-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4096-1 advisory. Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625....

Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2026-009)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2LIBREOFFICE-2026-009 advisory. LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed wh...

Improper Protection of Alternate Path

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to the blocklist mechanism operating at the import system level rather than accounting for the complete Python runtime. An attacker can...

CVE-2026-85129

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

CVE-2026-85129 Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

EUVD-2026-77086

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-85129 Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-37008

CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...

PT-2026-90963

Name of the Vulnerable Software and Affected Versions Hoo Companion WordPress plugin version 1.0.2 Description An import feature lacks authorization and validation checks and fails to sanitize submitted data before storing it as the active theme settings. This allows unauthenticated attackers to...

Python Import As an Execution Boundary: An Empirical Study of Bugs, Vulnerabilities, and Analysis Gaps

Python import does more than resolve dependencies: it executes code during module and package initialization. This behavior can trigger failures, load dynamic or native code, access resources, or change security-sensitive state before an application calls a package API. Prior work studies package...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

EUVD-2026-77111

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

PT-2026-90969

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...