295338 matches found
PT-2026-133172
TuxCare rebuilt @babel/plugin-transform-private-property-in-object to address 1 CVE. Fixed in 7.24.5-tuxcare.2...
PT-2026-133159
TuxCare rebuilt @babel/plugin-transform-block-scoping to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
PT-2026-133194
TuxCare rebuilt @babel/plugin-transform-destructuring to address 1 CVE. Fixed in 7.23.0-tuxcare.3...
PT-2026-131688
TuxCare rebuilt @babel/plugin-transform-block-scoped-functions to address 1 CVE. Fixed in 7.29.0-tuxcare.1...
PT-2026-131689
TuxCare rebuilt @babel/plugin-transform-block-scoped-functions to address 1 CVE. Fixed in 7.12.18-tuxcare.2...
PT-2026-131693
TuxCare rebuilt @babel/plugin-transform-block-scoped-functions to address 1 CVE. Fixed in 7.25.7-tuxcare.4...
CVE-2026-110034: Improper Input Validation
The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total...
CVE-2026-112779: Allocation of Resources Without Limits or Throttling
Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...
CVE-2026-112188: Exposure of Sensitive Information to an Unauthorized Actor
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...
CVE-2026-112306: Improper Neutralization of Special Elements used in an SQL Command
NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...
CVE-2026-89286: Exposure of Sensitive Information to an Unauthorized Actor
The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...
PT-2026-131687
TuxCare rebuilt @babel/plugin-transform-block-scoped-functions to address 1 CVE. Fixed in 7.18.9-tuxcare.2...
ALSA-2026:84744 Important: gimp:2.8 security update
The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: gimp:...
CVE-2026-112328: Missing Authorization
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...
CVE-2026-112329: Missing Authorization
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...
CVE-2026-112161: Insufficient Verification of Data Authenticity
MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...
CVE-2026-94294: Missing Authorization
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...
CVE-2026-94272: Missing Authorization
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...
CVE-2026-74921: Improper Neutralization of Input During Web Page Generation
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that...