@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +94 more potentially affected by CVE-2026-63461 via @vendure/core (>=1.9.5, <=3.4.4)

@vendure/core NPM version =1.9.5, =1.0.0, =1.0.4, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.2.4 and more Source cves: CVE-2026-63461 Source advisory: OSV:GHSA-XF65-R35X-WMMV...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-69247, CVE-2026-69248, CVE-2026-69249)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-69247 DESCRIPTION: cryptography is a package...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-49476, CVE-2026-49477)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-49476 DESCRIPTION: Soup Sieve is a CSS selector...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-45409)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Nam...

CVE-2021-43798-Grafana-path-traversal-tester

Grafana Path Traversal Tester This script automates the testing of known Grafana plugin endpoints for potential path traversal vulnerabilities using curl. 🛠 Features Reads target paths from a file e.g. paths.txt Sends HTTP requests using --path-as-is to bypass normalization Captures HTTP status...

CVE-2026-92917 Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters printr, vardump, jsonencode, yamlencode, string: GravExtension::assertSandboxDumpSafe determines sandbox state by calling SandboxExtension::isSandboxed without...

Malicious Package

Overview latam-xp-analytics-plugin-absmartly is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview latam-xp-analytics-plugin-gtm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

WordPress JWT Authentication for WP REST APIs plugin <= 4.7.0 - Unauthenticated Authentication Method Downgrade vulnerability

Unauthenticated Authentication Method Downgrade vulnerability discovered by Choriyev Qahramon in WordPress Plugin WordPress REST API Authentication versions = 4.7.0...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2025-15697: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

CVE-2026-91011: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-88792: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

CVE-2026-91017: Insufficient Verification of Data Authenticity

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders...

CVE-2026-87786: Improper Neutralization of Input During Web Page Generation

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order...

CVE-2026-86707: Improper Authentication

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

PT-2026-94225

Name of the Vulnerable Software and Affected Versions foreman ansible plugin affected versions not specified Description A flaw exists in the Ansible inventory API of the foreman ansible plugin. The controller utilizes an unscoped Host.where call to build host queries, which fails to enforce the...

PT-2026-94205

Name of the Vulnerable Software and Affected Versions foreman ansible plugin affected versions not specified Description A flaw exists in the Ansible override values API of the foreman ansible plugin. The destroy action resolves the target LookupValue record by ID but fails to verify if the recor...

PT-2026-94365

Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions prior to 6.2.2.0 Description The application fails to validate the URL scheme when verifying if a target URL is internal to the connected server. This allows a network-positioned attacker to load a plugin popout...

PT-2026-94158

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description The plugin fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to execute Reflected...