WordPress TranslatePress < 3.2.6 - Cross-Site Scripting

TranslatePress plugin 3.2.6 for WordPress contains a reflected cross-site scripting vulnerability in the translation marker processing feature, letting attackers inject and execute arbitrary JavaScript code, exploit requires no authentication or privileges. id: CVE-2026-17505 info: name: WordPres...

WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by improper enforcement of marker approval filter in admin-ajax fallback for datatables route, letting unauthenticated visitors retrieve unapproved marker records. id: CVE-2026-8385 info: name: WordPress W...

WP Go Maps < 10.0.10 - Unauthenticated Marker Information Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no...

CVE-2026-119329 Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...

CVE-2026-119329

The Immich photo and video management solution contains a vulnerability prior to version 3.0.0 . The GET /api/map/markers endpoint incorrectly processes partner owner identifiers in server/src/services/map.service.ts while applying archive visibility in server/src/repositories/map.repository.ts. ...

CVE-2026-119329: immich-app immich: Immich is a high-performance self-hosted photo and video management solution

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...

Mass-Scanner-CVE-2026-1405

⚡ Mass-Scanner-CVE-2026-1405 Clean WordPress Mass Scanner for CVE-2026-1405 🧠 Overview A clean and lightweight scanner built to check CVE-2026-1405 exposure across multiple WordPress targets. It focuses on: fast multi-target scanning clean terminal output simple result classification easy usage f...

Back to Basics: Formal Analysis Hints Improve Weak-To-Strong Monitoring

Frontier agentic systems are capable of taking misaligned actions that may cause significant harm. Monitoring techniques are developed to oversee these systems in order to detect and prevent dangerous actions. However, current state-of-the-art monitors suffer from four persistent failure modes:...

PT-2026-121662

Name of the Vulnerable Software and Affected Versions Authlib versions 1.3.1 through 1.8.9 Description An issue exists in the OctKey.import key function within authlib/jose/rfc7518/oct key.py where asymmetric-key markers are only checked at byte zero. Because PEM loaders accept leading whitespace...

An Initial Study of Physiological Markers for Deepfake Speech Detection

Conventional deepfake speech detectors primarily target synthesis artifacts and often degrade under unseen attacks or recording conditions. Human speech, however, contains physiological markers associated with respiration, phonation, and temporal coordination arising from the speech-production...

CVE-2026-96575 Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable rstrkeep Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. Thi...

PYSEC-2026-3863 Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Summary Mistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

SummaryMistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...

VulnCheck KEV: CVE-2026-75981

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Summary Mistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...

CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization

Incorrect Authorization vulnerability in ash-project ashtypescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField, which retains the real value in originalvalue because embedde...

CVE-2026-76098

A flaw was found in Mistune, a Python Markdown parser. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by submitting specially crafted Markdown input. The excessive use of emphasis markers, such as consecutive asterisks, creates deeply nested tokens during HTML...

CVE-2026-76098 Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

CVE-2026-54073

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at...

CVE-2026-56288

A flaw was found in GNU patch. An attacker can exploit this by providing a specially crafted patch file, which leads to a NULL pointer dereference. This improper handling of end-of-file markers can corrupt internal data structures, causing the utility to crash. This results in a denial of service...