CVE-2023-47668

CVE-2023-47668 Restrict Content = 3.2.7 - Information Exposure via legacy log file Description: The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.7 via the legacy log file. This makes it possible...

CVE-2026-102489

CVE-2026-102489: Zammad Unauthenticated Remote Code Execution This repository contains a proof of concept for CVE-2026-102489, an unauthenticated remote code execution vulnerability in Zammad. The exploit chains a WebSocket information disclosure flaw into authenticated session takeover and...

SonicWall NSM On-Prem Affected By Multiple Vulnerabilities

1 CVE-2026-96540 - SonicWall NSM On-Prem Improper Access Control VulnerabilityAn improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information...

Malicious code in @user-interface-common/common-styles (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

Malicious code in @mntv-analysis/ui-components (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 50.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

Malicious code in @mntv-analysis/workspaces-components (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 65.11.3 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', whic...

Malicious code in @mntv-analysis/ui (npm)

npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 99.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...

EUVD-2026-100872

Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...

CVE-2026-110466 WisdomGarden｜Tronclass - Sensitive Data Exposure

Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...

CVE-2026-110466

The Tronclass software, developed by WisdomGarden , contains a Sensitive Data Exposure vulnerability (CWE-497). Authenticated remote attackers can bypass anonymous grading restrictions to obtain anonymous student information . No specific patch versions, workarounds, or evidence of in-the-wild ex...

RLSA-2026:82345 Important: OpenEXR security update

OpenEXR is a high dynamic-range HDR image file format developed by Industrial Light & Magic for use in computer imaging applications. This package contains libraries and sample applications for handling the format. Security Fixes: OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EX...

OpenEXR security update

An update is available for OpenEXR. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenEXR is a high dynamic-range HDR image file format developed by Industrial...

CVE-2026-110459

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service DoS attack on the device...

CVE-2026-110457

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device...

EUVD-2026-100870

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

CVE-2026-96904

The AWP Classifieds WordPress plugin, in versions prior to 4.4.9 , contains a vulnerability that allows unauthenticated attackers to bypass ownership checks. By referencing a payment transaction on the Place Ad page, an attacker can disclose the private contact email stored on any listing. No spe...

CVE-2026-96904 AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page

The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allowing unauthenticated attackers to bypass the ownership check on the ad submission page and read the private contact email stored on any...

EUVD-2026-100861

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-90989 Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-90989

The Tainacan WordPress plugin before version 1.4.0 contains a vulnerability where its reports REST endpoints lack proper access controls. Specifically, the plugin fails to restrict these endpoints to users with management capabilities, which allows any authenticated subscriber to disclose the ema...