CLSA-2026-1793154869 TuxCare security update for @babel/plugin-proposal-partial-application (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 1 CVE. Fixed in 7.24.5-tuxcare.2...

CLSA-2026-1793154868 TuxCare security update for @babel/plugin-proposal-partial-application (2 CVEs)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 2 CVEs. Fixed in 7.24.5-tuxcare.1...

CLSA-2026-1793154867 TuxCare security update for @babel/plugin-proposal-partial-application (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 1 CVE. Fixed in 7.12.5-tuxcare.2...

CLSA-2026-1793154866 TuxCare security update for @babel/plugin-proposal-partial-application (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1793154863 TuxCare security update for @babel/plugin-proposal-partial-application (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

CLSA-2026-1793154864 TuxCare security update for @babel/plugin-proposal-partial-application (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 1 CVE. Fixed in 7.29.0-tuxcare.2...

CLSA-2026-1793154865 TuxCare security update for @babel/plugin-proposal-partial-application (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1793154860 TuxCare security update for @babel/plugin-proposal-partial-application (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

CLSA-2026-1793154862 TuxCare security update for @babel/plugin-proposal-partial-application (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

CLSA-2026-1793154859 TuxCare security update for @babel/plugin-proposal-partial-application (2 CVEs)

TuxCare rebuilt @babel/plugin-proposal-partial-application to address 2 CVEs. Fixed in 7.22.6-tuxcare.1...

CVE-2025-6082

CVE-2025-6082 Full Path Disclosure PoC Author : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-6082 Vulnerability : Full Path Disclosure CWE-200 Description This Proof‑of‑Concept exploits a Full Path Disclosure bug in the Birth Chart Compatibility WordPress plugin versions ≤ 2.0. The POC send...

CVE-2026-103330: Unknown Sadad QA Payment: The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment…

The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to...

PT-2026-128302

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.588 Jenkins LTS versions prior to 2.580.2 Description An issue exists where launch commands in older agent configurations are converted into launchers provided by the Command Agent Launcher Plugin without...

CVE-2026-115255: Unknown WP Roster: The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions,…

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members...

CVE-2026-15323: King-Theme Product Designer for WooCommerce WordPress | Lumise: The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in…

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...

CVE-2026-111967: Unknown MP3 Audio Player: The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before…

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrat...

PT-2026-127814

Name of the Vulnerable Software and Affected Versions Payconiq WordPress plugin versions prior to 1.0.5 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. The plugin fails to verify if a visitor is authorized to view an order before...

CVE-2026-106002: Unknown Court Reservation: The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of…

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise from the failure to verify whether an administrator has approved the startup command in the old agent configuration when converting it to a launcher provided by th...

PT-2026-129219

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...