The vulnerability of the java() function in the nltk/internals.py file of the NLTK library, a software package for symbolic and statistical processing of natural language, allows a hacker to gain control over the system.

The vulnerability of the java function in the nltk/internals.py file of the NLTK library, a software package for symbolic and statistical processing of natural language, is related to the implementation or modification of arguments. Exploiting this vulnerability could allow an attacker to gain...

The vulnerability of the POS platform component of Oracle Hospitality Simphony allows a malicious individual to gain unauthorized access to read, create, delete, and modify data, or to cause service interruptions.

The vulnerability of the Oracle Hospitality Simphony sales management platform component relates to insufficient access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read, create, delete, and modify data, or cause service interruptions...

The vulnerability of the configuration file 4_testintegration_fim-tier-0-1-win.yml on the Wazuh security monitoring and threat detection platform allows a perpetrator to gain access to and modify this data.

The vulnerability of the configuration file 4testintegrationfim-tier-0-1-win.yml of the security monitoring and threat detection platform Wazuh is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to gain read access and modify data...

Linux Distros Unpatched Vulnerability : CVE-2026-18712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause...

CVE-2026-86498: Incorrect Authorization

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission...

Malicious code in dorado-module-centauri-procyon (npm)

Source: amazon-inspector 9dc48c5da0d6de22d1a878291edfa6b66e1ba73e9a36bab77ba8939963d3e8cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dian-tiwul56-miaww (npm)

Source: amazon-inspector 4f70fde307d6a59e524163c7082f083c1daf5014b4e7963bd97181ab0be4fddd The package dian-tiwul56-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These package...

Malicious code in delicious_yak_z3n (npm)

Source: amazon-inspector 80d6e988538d40cd5ec11d4394488f7353225d6575f6daaefb7cdff4c6892ac7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

OESA-2026-3600 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A TOCTOU Time-of-Chec...

OESA-2026-3598 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A TOCTOU Time-of-Chec...

OESA-2026-3597 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A TOCTOU Time-of-Chec...

CVE-2025-9049

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokriaccountmemberpermissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with...

WordPress Custom Contact Forms plugin <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Deletion and Post Meta Modification via Nested 'fields.ID' / 'choices.ID' Parameters vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Custom Contact Forms versions = 7.16...

CVE-2026-75018 Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-75018

Custom Contact Forms WordPress plugin (all versions up to and including 7.16 ) contains an authorization bypass due to missing capability checks on nested fields[].ID and choices[].ID parameters processed by _create_and_map_fields() and _create_and_map_choices(). While the top-level form ID is gu...

CVE-2026-75018 Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters

The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-84225

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cann...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Google Reviews Modification vulnerability

Contributor+ Google Reviews Modification vulnerability discovered by Artus KG in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

WordPress Kirki plugin 6.0.0-6.2.5 - Authenticated Collaboration Comment Status Modification vulnerability

Authenticated Collaboration Comment Status Modification vulnerability discovered by Revanth Meesala in WordPress Plugin Kirki versions 6.0.0-6.2.5...

CVE-2026-84225 Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cann...