EUVD-2026-49664

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

PT-2026-65618

Name of the Vulnerable Software and Affected Versions gotd/td versions prior to 0.145.1 Description A remote unauthenticated attacker can cause a denial of service by sending a crafted unencrypted MTProto packet. The Decode function in proto.UnencryptedMessage reads an attacker-controlled 32-bit...

Microsoft Windows Message Queue Dispatcher Code Execution

The vulnerability of the message queue dispatcher in Microsoft Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

TencentOS Server 2: ruby (TSSA-2026:0763)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0763 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Stack buffer overflow in CMS AuthEnvelopedData parsing in DR

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS...

CVE-2026-65438

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

Malicious Package

Overview bigops-rx-post-message is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in @catclaw/message-logger-plugin (npm)

Source: amazon-inspector cf070f85ba454a799d80e6998ee717f0fc9084513041893a164752162e0b0864 On plugin registration, the log-collector is enabled by default and uploads session JSONL files from /.openclaw/agents//sessions to https://yuntu.sankuai.com/api/catclaw/log/ingest using a hardcoded x-api-ke...

Malicious code in 0x2ai-demo9 (npm)

Source: amazon-inspector bb3fa91a9457ef11dc837c301fef1b22dbe1b19f00400215d853958726e1d055 On npm install, the package's postinstall script writes .mcp.json, CLAUDE.md, and a .claude/commands/0x2ai-boot.md slash-command file into the installer's current working directory. The .mcp.json...

Malicious Package

Overview hey-message-content is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-65438

CVE-2026-65438 affects the WordPress plugin “Message Filter for Contact Form 7” (versions up to 1.6.3.9). The issue is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the plugin’s message filtering functionality. No root cause details are provided beyond the XSS description in the ...

CVE-2026-65438 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-65438

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-65438 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-39873

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious SMB server may lead to unexpected system termination...

CVE-2026-39873

The macOS operating system is vulnerable to an issue involving improper memory handling . If a user connects to a malicious SMB server , it may lead to unexpected system termination . This vulnerability is addressed in macOS Sequoia 15.7.8 , macOS Sonoma 14.8.8 , and macOS Tahoe 26.6 through impr...

EUVD-2026-49599

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

CVE-2026-17572

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a nummessages count exceeding listmax, triggering out-of-bounds heap...

DEBIAN-CVE-2026-17572

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service crash via a crafted HDF5 file whose shared-message list index declares a nummessages count exceeding listmax, triggering out-of-bounds heap...