EUVD-2026-74907

VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length, which writes no terminator when the source line is at least as long...

CVE-2026-73324

VLC media player 3.0.0 through 3.0.23 is affected by a heap out-of-bounds read in the RTSP module. The root cause is that RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length without guaranteeing null termination, and rtsp_get in modules/access/rtsp/rtsp.c passes...

CVE-2026-73324 VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory...

RLSA-2026:64815 Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

Malicious code in cache-cleanup-module (npm)

Source: amazon-inspector 2931c2feef07a63612b0886a1840e519516424af0fbf4fb0a138e97736a18857 cache-cleanup-module ships an exported runOperation that queries a hardcoded third-party endpoint at https://testback-2aqe.onrender.com/can-cleanup authenticated with a static x-api-key token...

CVE-2026-80099

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-16272

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

EUVD-2026-74773

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the "authenticate" method — registered on the "restauthenticationerrors" filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099

CVE-2026-80099 affects several Newfold WordPress plugins (Crazy Domains, Web, Hostgator, Bluehost) that bundle the wp-module-data module. The root cause is an HMAC-style Bearer token validation flaw : when HiiveConnection::get_auth_token() returns false, PHP coerces strrev(false) to an empty stri...

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099 Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-16272 Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16272

PayTR Virtual Pos iFrame API (v9x) WHMCS Module (versions v9.0.0 through before v9.0.3) is affected by a client IP spoofing vulnerability caused by use of less trusted source —specifically, untrusted HTTP headers are relied upon for identifying the client IP, allowing exploitation of trusted iden...

EUVD-2026-74769

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16272 Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

WordPress WP Module Data plugin <= 2.9.7 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by sorin vasile in WordPress Plugin WP Module Data versions = 2.9.7...

MAL-2026-16078 Malicious code in cache-cleanup-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2931c2feef07a63612b0886a1840e519516424af0fbf4fb0a138e97736a18857 cache-cleanup-module ships an exported runOperation that queries a hardcoded third-party endpoint at https://testback-2aqe.onrender.com/can-cleanup...

Malicious code in cache-cleanup-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2931c2feef07a63612b0886a1840e519516424af0fbf4fb0a138e97736a18857 cache-cleanup-module ships an exported runOperation that queries a hardcoded third-party endpoint at https://testback-2aqe.onrender.com/can-cleanup...