CVE-2026-89278

GPTranslate – Multilingual AI Translation Agent for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 2.34.6 . The plugin's enqueue_frontend_scripts function embeds a plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or...

CVE-2026-88798

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

EUVD-2026-82676

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-81810 All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site...

CVE-2026-81810 All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site...

EUVD-2026-82584

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...

SUSE CVE-2026-93161

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qatalgxtsreversekey expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary cryptoaesctx with...

openSUSE 16: libmbedcrypto7 / libmbedcrypto7-x86-64-v3 / libmbedtls14 / etc (openSUSE-SU-2026:21864-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21864-1 advisory. Changes in mbedtls-2: - CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs...

SUSE SLES15 Security Update : cjose (SUSE-SU-2026:4253-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4253-1 advisory. - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap- based buffer overflow...

openSUSE 16: libknet-devel / libknet1 / libknet1-compress-bzip2-plugin / etc (openSUSE-SU-2026:21851-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21851-1 advisory. - CVE-2026-15811: improper sanitization of sensitive memory locations following cryptographic configuration adjustments can lead to potential...

Linux Distros Unpatched Vulnerability : CVE-2026-93161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: qat - clear AES key schedule from stack qatalgxtsreversekey expands the forward XTS AES key on the stack. That schedule contains key material and can...

SUSE SLES12 Security Update : cjose (SUSE-SU-2026:4237-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4237-1 advisory. - CVE-2026-53938: missing encryptedkey length validation during AES Key Wrap decryption can cause heap- based buffer overflow...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3714)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

Linux Distros Unpatched Vulnerability : CVE-2026-90102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct...

PT-2026-95593

Name of the Vulnerable Software and Affected Versions deepmerge versions prior to 4.3.2 Description The mergeObject function fails to properly validate keys written to target objects, leading to prototype poisoning. This occurs when a crafted source object containing keys such as proto ,...

CVE-2026-89278: Exposure of Sensitive Information to an Unauthorized Actor

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueuefrontendscripts. This makes it possible for unauthenticated attackers to...

CVE-2026-88798: Uncontrolled Resource Consumption

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-79713: Inconsistent Interpretation of HTTP Requests

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from...

CVE-2026-12384: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects TECHIN2B Application: from V1.0.7676.13 through 18092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

JFrog Artifactory < 7.146.35 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.146.35. It is, therefore, affected by the following vulnerabilities. - An authentication weakness that, under default configuration, may allow an unauthenticated attacker wit...