CVE-2025-15696: Improper Neutralization of Input During Web Page Generation

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...

PT-2026-97162

Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description A REST collection endpoint is not scoped to the requesting user, which allows users with subscriber-level accounts t...

PT-2026-97197

Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11 Description Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary...

PT-2026-97568

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description When no CA bundle is available, the ssl options/1 function fal...

Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

PT-2026-97589

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description The AMQP 1.0 shovel stores the raw connection URI including th...

PT-2026-97174

Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description A broken access control issue exists where the software fails to verify the post status of linked records before including their stored details in a public REST API...

CVE-2026-96260

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

EUVD-2026-84870

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260

The Mattermost server is vulnerable to a denial of service because it fails to enforce a request body size limit during CSRF validation of plugin requests. This flaw allows an authenticated user to exhaust server memory by sending a large request body to a plugin endpoint. Affected versions inclu...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (6.3.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (6.3.0) +3 more potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=6.3.0, <=6.3.13)

org.graylog2:graylog2-server MAVEN version =6.3.0, =6.3.0, =6.3.0, =6.3.13 Source cves: CVE-2026-69190 Source advisory: GHSA-M9C2-85GV-8XR5...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.8)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.8 Source cves: CVE-2026-69190 Source advisory: OSV:GHSA-M9C2-85GV-8XR5...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.8)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.8 Source cves: CVE-2026-69190 Source advisory: SNYK:JAVA-ORGGRAYLOG2-20079479...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-69190 Source advisory: OSV:GHSA-M9C2-85GV-8XR5...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-69190 Source advisory: SNYK:JAVA-ORGGRAYLOG2-20079479...