edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-115910 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-115910 Source advisory:...

ducktape (>=0.7.16, <=0.7.23), neon-api-proxy (>=0.1.7a0, <=0.2.1a4) +4 more potentially affected by CVE-2026-112909 via filelock (3.2.1)

filelock PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on filelock and may be impacted: - ducktape =0.7.16, =0.1.7a0, =0.9.1a1, =0.15.1a0 - pcapprocessor 0.1.0 Source cves: CVE-2026-112909 Source advisory: OSV:GHSA-69HJ-F68J-2879...

GHSA-VWCJ-R8V9-P53F vulnerabilities

Vulnerabilities for packages: containerd, external-dns, snyk-cli, zot, kubernetes, wuzz, prometheus-operator, hubble, step-issuer, cilium-cli, minio, runc, flux, k6, k3s, opentelemetry-collector, gitea, kine, cert-manager, mailpit, spire-server, loki, step, helm, kaf, nerdctl, kyverno, kots,...

CVE-2026-117602

A flaw was found in Electrum. The external plugin loader does not verify authorization signatures before executing enabled plugins. A local attacker with write access to the application data directory can place malicious plugin code into the plugins folder and enable it in the configuration file...

CVE-2026-111804

A flaw was found in Apache Traffic Server's experimental WebAssembly WASM plugin. A remote attacker can trigger a use-after-free condition during transaction closure or supply unvalidated metric identifiers to the internal statistics interface. This flaw allows an attacker to cause an application...

WordPress Schema App Structured Data plugin <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Schema App Structured Data versions = 2.3.2...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - Unauthenticated Media Upload Description The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. Usage: usage:...

Malware in dsh-plugin-blender-3d

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

WordPress DSGVO All in one for WP plugin <= 5.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin DSGVO All in one for WP versions = 5.0...

WordPress SSL Wireless SMS Notification plugin <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover vulnerability

Unauthenticated Authentication Bypass to Account Takeover vulnerability discovered by antaloaalonso in WordPress Plugin SSL Wireless SMS Notification versions = 3.8.1...

WordPress Cherry Plugin plugin < 1.2.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by ? in WordPress Plugin Cherry Plugin versions 1.2.7...

WordPress socialfit plugin <= 1.2.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Sammy Forgit in WordPress Plugin SocialFit versions = 1.2.2...

CVE-2026-117614

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

CVE-2026-117614

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

CVE-2026-117614

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

CVE-2026-117614

Jenkins versions 2.587 and earlier , and LTS 2.580.1 and earlier , are vulnerable to an agent launch command approval bypass (CVE-2026-117614 ). The software converts launch commands from older agent configurations into launchers provided by the Command Agent Launcher Plugin without verifying adm...

EUVD-2026-112179

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

CVE-2026-117614

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

CVE-2026-67187

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...

CVE-2026-67187

The Ninja Forms plugin for WordPress (before version 3.15.4 ) is vulnerable to a server-side validation bypass in various list fields, including Checkbox List, Multi-Select List, Image List, Country, and State. The root cause is that NF_Abstracts_List falls through to a validate() method that fai...