nvidia-dali-tf-plugin-cuda120 (2.2.0) potentially affected by CVE-2026-65149 via nvidia-dali-cuda120 (2.2.0)

nvidia-dali-cuda120 PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-dali-cuda120 and may be impacted: - nvidia-dali-tf-plugin-cuda120 2.2.0 Source cves: CVE-2026-65149 Source advisory: MEND:CVE-2026-65149...

nvidia-dali-tf-plugin-cuda120 (2.2.0) potentially affected by CVE-2026-65147 via nvidia-dali-cuda120 (2.2.0)

nvidia-dali-cuda120 PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-dali-cuda120 and may be impacted: - nvidia-dali-tf-plugin-cuda120 2.2.0 Source cves: CVE-2026-65147 Source advisory: MEND:CVE-2026-65147...

SQL Injection

Overview @payloadcms/plugin-mcp is a MCP Model Context Protocol capabilities with Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticated attacker ca...

WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by AndrewN in WordPress Plugin Amelia versions = 2.4.10...

WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin MLS On The Fly versions = 1.8.1.5...

WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Prime Slider – Addons For Elementor versions = 4.7.1...

CVE-2026-109684 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10...

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Parlix in WordPress Plugin Amelia versions = 2.4.10...

WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Heinrihs Skrodelis in WordPress Plugin WPGraphQL versions = 2.24.2...

WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay Payment Button Elementor Plugin versions = 1.2.8...

Malicious code in orderly-plugin-liquidity-heatmap (npm)

orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs node ./scripts/setup.js on npm install. When the script detects GitHub Actions CI and GITHUBWORKSPACE set, it records the...

CVE-2026-89271

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

CVE-2026-89269

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,...

WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin YouTube Showcase versions = 4.1.0...

CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-82417 DESCRIPTION: Summary...

[SECURITY] Fedora 43 Update: python-mkdocs-rss-plugin-1.17.7-5.fc43

This package provides a plugin for MkDocs, the static site generator, which creates RSS 2.0 and JSON Feed 1.1 feeds using the creation and modification dates from git log and page metadata YAML frontmatter...

[SECURITY] Fedora 44 Update: python-mkdocs-rss-plugin-1.17.7-5.fc44

This package provides a plugin for MkDocs, the static site generator, which creates RSS 2.0 and JSON Feed 1.1 feeds using the creation and modification dates from git log and page metadata YAML frontmatter...

PT-2026-111678

Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.10.0 Description The JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods because PermissionEnforcer::enforce allows methods that lack a RequiresPermission attribute. An...