268271 matches found
Malicious code in insomnia-plugin-api-lint-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...
MAL-2026-17561 Malicious code in insomnia-plugin-api-lint-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...
CVE-2026-104713: Allocation of Resources Without Limits or Throttling
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...
ALSA-2026:75575 Important: gimp security update
The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: gimp:...
PT-2026-106135
Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.8 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description The REST plugin allows request bodies to be read into...
RHEL 9 : gimp (RHSA-2026:75575)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:75575 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...
PT-2026-104764
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2...
CVE-2026-105397: Improper Neutralization of Input During Web Page Generation
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...
CVE-2026-84169: Authorization Bypass Through User-Controlled Key
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...
CVE-2026-104401: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2...
Important: gimp security update
The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: gimp:...
WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...
WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
WordPress Progressify - Progressive Web App PWA plugin = 1.6.0 - Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Progressify - Progressive Web App PWA versions = 1.6.0...
WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin Smart Forms versions = 2.6.104...
WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by ParkHyunWoo in WordPress Plugin PDF Smart Viewer for Elementor versions = 1.0.4...
WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Progress Planner versions = 1.10.0...
WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by Eunho Kim in WordPress Plugin PDF for Contact Form 7 versions = 7.1.0...
WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Sakri Koskimies in WordPress Plugin BEAR versions = 1.2.2...
CVE-2026-17005
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...
WordPress User Private Files plugin < 2.2.0 - Unauthenticated Private File Disclosure vulnerability
Unauthenticated Private File Disclosure vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin User Private Files versions 2.2.0...