WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Jakub Herman in WordPress Plugin ProfilePress versions = 4.17.4...

linux-insides

linux-insides A book-in-progress about the Linux kernel and its insides. Introduction • Chapter status • Requirements • Translations • Contributing • Author Introduction linux-insides is a book-in-progress about the Linux kernel and its insides. The goal of this project is simple - to share...

EUVD-2026-91776

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

CVE-2026-94484

A flaw was found in Next.js. Applications configured with root-level catch-all pages and static routes share a response cache key that does not properly distinguish between different routes. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request t...

Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes

Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules CSM that could be exploited by bad actors to take over susceptible systems. The vulnerabilities are listed below - CVE-2026-63688 CVSS score: 10.0 - A missing authentication for critic...

CVE-2026-94484

The Next.js React framework is vulnerable to cache poisoning in versions 15.0.0 through 15.5.27 and 16.3.8 . The root cause is an insufficiently scoped shared response cache key used by applications with a root-level catch-all page and statically generated or Incremental Static Regeneration (ISR)...

CVE-2026-104415

The Ghost platform (versions 0.7.2 before 6.64.0 ) contains an information disclosure vulnerability within the Admin API . Authenticated users with staff-level privileges can query the Admin API to determine the relative ordering of password hashes belonging to other staff users. While this allow...

CVE-2026-104415 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

CVE-2026-97634

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-97338

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-96647

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-102002

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

CVE-2026-96647 Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-91255

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsdremark' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-91257

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-97338

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.70 . The root cause is insufficient input sanitization and output escaping within the display name field. An authenticated attacker with Subscriber-level access or ...

CVE-2026-96647

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.1.1 . The root cause is insufficient input sanitization and output escaping of the 'lsd[remark]' parameter. This a...