CVE-2026-106348

An information leak flaw was found in the Animation component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/537107728...

WordPress AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin AutomatorWP versions = 5.8.4...

CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

EUVD-2026-95973

Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...

EUVD-2026-95961

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...

CVE-2026-107842 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...

CVE-2026-107842

The Contao Open Source CMS (versions 4.0.0 through 5.3.50 and 5.7.12) contains a vulnerability in ModuleSearch where protected page titles, URLs, and context snippets are disclosed to unauthenticated visitors. This occurs when the contao.search.index_protected setting is changed from enabled to d...

CVE-2026-107842 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...

CVE-2026-107817

A flaw was found in the mysqljson plugin in MariaDB. The plugin incorrectly assumes that imported MySQL tables contain valid binary JavaScript Object Notation JSON data. An attacker can exploit this issue by supplying a specially crafted MySQL table containing invalid JSON data, triggering an...

CVE-2026-106330

An information leak flaw was found in the Paint component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553135213...

CVE-2026-106321

An information leak flaw was found in the Editing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556235808...

CVE-2026-106277

An information leak flaw was found in the Animation component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517708426...

CVE-2026-106254

An information leak flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/557036053...

Malicious code in kmf-vendor-pack (npm)

Source: amazon-inspector 95ddc660098b1c73a1899ad3fe471b53ce562ca033669fa64622ff386d774129 package.json defines a postinstall script that invokes node -e to issue an HTTPS GET to the attacker-controlled out-of-band callback host db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast.pro, embedding the installer's...

CVE-2026-107816

A flaw was found in MariaDB. An authenticated user can execute a database query containing embedded null bytes, which misleads the query cache information qcinfo plugin. When the cached query details are later read from the information schema, the server accesses memory beyond the allocated buffe...

CVE-2026-106424

An information leak flaw was found in the Audio component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513365978...

CVE-2026-106415

An information leak flaw was found in the Enterprise component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502179715...

CVE-2026-106342

An information leak flaw was found in the Autofill component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/512998592...

CVE-2025-49493

Akamai CloudTest XXE Exploit CVE-2025-49493 Overview This is a Python-based exploit for CVE-2025-49493 , which affects Akamai CloudTest versions before 60 2025.06.02 12988. The vulnerability allows for XML External Entity XXE injection through the SOAP service endpoint. Vulnerability Details CVE ...

DEBIAN-CVE-2026-107816

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qcinfo plugin could be confused by a query containing embedded null bytes. Reading informationschema.querycacheinfo after such a query was cached could acces...