CVE-2026-73491

A flaw was found in Loofah. The Loofah::HTML5::Scrub.alloweduri? function fails to properly detect javascript: Uniform Resource Identifiers URIs when their scheme is split or prefixed with HTML5 named whitespace character references, such as or . This vulnerability allows a remote attacker to cra...

CVE-2026-73626

A flaw was found in JupyterLab where a missing 'await' in the PyPIExtensionManager.install function could lead to an allowlist/blocklist enforcement gap. This vulnerability allows direct callers of install to bypass security checks, potentially enabling the installation of unauthorized extensions...

CVE-2026-19836 Webkul Bagisto Backend Customer Detail Feature view authorization

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...

CVE-2026-19836

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...

EUVD-2026-58682

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...

CVE-2026-73651

A flaw was found in TypeORM. TypeORM's migration:generate command, used for generating database migrations, embeds database schema metadata into JavaScript or TypeScript template literals. This process incorrectly escapes backticks but fails to escape interpolation, creating a vulnerability. An...

CVE-2026-73295

A flaw was found in Material for MkDocs. A DOM-based Cross-Site Scripting XSS vulnerability exists in the search suggestion feature. A remote attacker could exploit this by crafting a malicious URL with a specially designed query parameter. After user interaction, this could lead to the execution...

CVE-2026-73625

A flaw was found in GitPython. Attackers can bypass the checkunsafeoptions guard by smuggling git options within single-character keyword argument kwarg values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as clonefrom or fetch, leading to...

CVE-2026-73627

A flaw was found in JupyterLab. An authenticated user can bypass administrator lock rules in the plugin manager by making direct requests to the /lab/api/plugins endpoint. This allows them to enable or disable plugins that were locked, including child plugins and those locked via the 'lock all'...

CVE-2026-73643

A flaw was found in js-yaml, a JavaScript YAML parser. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections. This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU...

CVE-2026-73416

A flaw was found in jupyterlab. The PyPI Python Package Index extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. This allows an authenticated user to bypass blocklist restrictions by using an alternative spelling of a...

CVE-2026-19834 Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...

CVE-2026-19834

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...

EUVD-2026-58671

A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated...

CVE-2026-19834

Technical details about CVE-2026-19834 are not publicly available in the provided documents. Based on the supplied sources, only high-level description is given; no verified affected versions, vulnerable components, exploit specifics, or remediation steps are included. Monitor for updates.

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)

Last week, there were 270 vulnerabilities disclosed in 213 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 140 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

exp-labs

exp-labs Cybersecurity Training Platform This modern web secu...

CVE-2026-1621

Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers. This issue affects E-Municipality: from 20251127 before 20260204...

CVE-2026-53472

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

MAL-2026-14037 Malicious code in tailwind-plugin-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e480310d422f93f8558763cca56b726148c94b19e20eec879f0786c01c264af The package presents itself as a Tailwind CSS plugin toolkit but its exported getPlugin function performs an HTTPS request to a hardcoded bare-IP...