CVE-2026-16261 Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...

PT-2026-67101

Name of the Vulnerable Software and Affected Versions login-social WordPress plugin versions prior to 1.0.5 Description This issue occurs because the plugin fails to validate password-reset requests against a reset key or the identity of the requester. Additionally, it generates authentication...

MINI-H8HQ-FV2M-HR2H

Bulletin has no description...

MINI-3FR7-VCMW-VHP6

Bulletin has no description...

UBUNTU-CVE-2026-67354

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

EUVD-2025-210583

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

EUVD-2026-51841

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

EUVD-2026-51847

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-17555

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the exportdata parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values a...

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

CVE-2026-13329

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders...

Injection axios Dependency in Crowd Data Center

This High severity Injection vulnerability was introduced in versions 6.0.0, 6.1.2, 6.2.0, 6.3.6, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This Injection vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N allows an unauthenticated attack...

MITM (Man-in-the-Middle) org.postgresql:postgresql Dependency in Crowd Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 6.2.0, 6.3.0, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:4.0/AV:N/AC:H/AT: P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N...

MINI-V68P-FXM7-WCG3

Bulletin has no description...

SUSE CVE-2026-58404

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including...

openSUSE 16 Security Update : s2n (openSUSE-SU-2026:21501-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21501-1 advisory. Changes in s2n: - CVE-2026-16318: Denial of Service due to memory leak in QUIC transport parameters handler bsc1272352 - CVE-2026-16317:...

CGA-66QQ-R76G-3HCC

Bulletin has no description...

CVE-2026-54785 gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to th...

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

In this article 1. The CaptiveCrunch campaign 2. Storm-2945 and Midnight Blizzard 3. CaptiveCrunch tradecraft and tooling 4. How to protect against CaptiveCrunch activity 5. Microsoft Defender detections and hunting guidance 6. Indicators of compromise Since early May 2026, Microsoft Threat...

GHSA-P849-8HWH-84J9 NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

Summary GET /api/myInAppChannels:list accepts a structured filter query parameter. The handler for the latestMsgReceiveTimestamp field splices the $lt value directly into a Sequelize.literal template string with no escape, type cast, or parameter binding. The action ACL is loggedIn, so any...