GP Premium <= 2.4.0 - Cross-Site Scripting

The GP Premium plugin for WordPress up to 2.4.0 is vulnerable to reflected XSS via the 'message' parameter in inc/verify.php lines 95-101, where a message passed with slactivation=false is URL-decoded and used unsanitized in addsettingserror, allowing XSS payloads to be reflected in admin notices...

CVE-2026-108884: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notificati...

Fedora 43 : openbao (2026-12caf78d6a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-12caf78d6a advisory. Update to upstream 2.6.4. Includes multiple GHSA security notices, see https://github.com/openbao/openbao/releases/tag/v2.6.4 Tenable has extracted the...

CVE-2026-96827

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

CVE-2026-96827

The WordPress Admin Notices Manager plugin (versions

CVE-2026-96827 WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

CVE-2026-96827 WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

EUVD-2026-89879

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

PT-2026-103211

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

CVE-2026-96827: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Admin Notices Manager = 1.6.0 versions...

WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Admin Notices Manager versions = 1.6.0...

EUVD-2026-80859

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide...

CVE-2026-92601

Guns through version 8.3.5 , a Java-based enterprise admin framework, contains an improper access control flaw in SysNoticeController . The underlying cause is that the requiredPermission flag defaults to false and is never overridden by any action method, effectively bypassing permission checks....

CVE-2026-92601: Missing Authorization

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide...

PT-2026-93860

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide...

20+ Hijacked Government Websites Became
an Attack Channel

More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions. The investigation revealed previously undocumented...

CVE-2026-50399

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:52+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:02+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:32+00:00| seen|...

CVE-2026-50456

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:35+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:52+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:17+00:00| seen|...

CVE-2026-50310

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:30+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:03:56+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:10+00:00| seen|...

CVE-2026-4298

The CVE-2026-4298 entry concerns the WordPress plugin DSGVO All in one for WP up to version 4.9. The underlying root cause is Missing Authorization due to the function dsgvo_reset_policy_service_func() lacking capability checks and nonce verification when processing user-supplied parameters to re...