CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-19949

The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....

Malicious code in css-import-order (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4 package.json declares the package's own name css-import-order as both a dependency and devDependency pointing at...

MAL-2026-14473 Malicious code in css-import-order (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4 package.json declares the package's own name css-import-order as both a dependency and devDependency pointing at...

CVE-2026-15023

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-15023 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-15023

The Events Manager WordPress plugin (versions up to and including 7.4.0 ) is vulnerable to a second-order SQL injection via the stored meta_key field in the Event/Location Duplicate action. An attacker with contributor-level or higher access plants SQL metacharacters into a custom meta key throug...

CVE-2026-15023 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-65194

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-82024

Fleet: ORDER BY column injection on activity list endpoints in github.com/fleetdm/fleet...

PT-2026-81122

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-72705

A flaw was found in Rocq Prover. The guard checker component fails to properly track recursive calls when a fixpoint passes itself as a higher-order argument to another fixpoint. This oversight allows for the creation of a type that is logically equivalent to its own negation, which can lead to t...

CVE-2026-72705

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function t...

CVE-2026-72705

CVE-2026-72705 is a soundness flaw in the guard checker of Rocq Prover (before 9.2.0). The checker fails to track recursive calls when a fixpoint passes itself as a higher-order argument to another fixpoint, which then applies it to a non-subterm value. This admits a type definitionally equal to ...

CVE-2026-72705 Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function t...

CVE-2026-72705 Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function t...

CVE-2026-72705 Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may pass itself as a higher-order argument to a second fixpoint, which then applies it to a value that is not a subterm of the structural argument. Passing the recursive function t...

Exploit for CVE-2026-63039

CVE-2026-63039 — Apache InLong AuditAlertRule ORDER BY SQL i...

Malicious code in @grab-food/order-sdk-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa9b56bb1d69dc16b6095faea196af99809ad805b400a3c6b5499f896c8d74c2 Package published under a scope impersonating the Grab food-ordering brand with no real functionality index.js exports an empty object. Its sole...

MAL-2026-15681 Malicious code in @grab-food/order-sdk-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa9b56bb1d69dc16b6095faea196af99809ad805b400a3c6b5499f896c8d74c2 Package published under a scope impersonating the Grab food-ordering brand with no real functionality index.js exports an empty object. Its sole...