CVE-2026-33228

flatted is a circular JSON parser. Prior to version 3.4.2, the parse function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with th...

WordPress Watu Quiz plugin <= 3.4.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered by Lucio Sá in WordPress Plugin Watu Quiz versions = 3.4.1...