EUVD-2026-109224

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user wh...

EUVD-2026-109223

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

WordPress News Kit Addons For Elementor plugin < 1.4.9 - Subscriber+ Plugin Installation and Activation vulnerability

Subscriber+ Plugin Installation and Activation vulnerability discovered by Usama Arshad in WordPress Plugin News Kit Elementor Addons versions 1.4.9...

CVE-2026-97352 News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from t...

CVE-2026-113489 GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

CVE-2026-110956

The asVereinbase WordPress plugin, in versions prior to 1.1.8 , contains an authentication bypass vulnerability. The flaw occurs because the plugin fails to require a valid password or a genuine second factor, instead treating an empty stored value as a successful match. This allows an unauthenti...

CVE-2026-113489

The GeoDirectory WordPress plugin versions prior to 2.8.194 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access or higher to modify the title,...

CVE-2026-97352 News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from t...

EUVD-2026-109229

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a...

PT-2026-122501

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user wh...

MiracleLinux 8 : grafana-9.2.10-35.el8_10 (AXSA:2026-2136:30)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2136:30 advisory. grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION CVE-2026-15815 Tenable has extracted the preceding description block...

Medium: alsa-lib

Issue Overview: alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state fil...

Important: mariadb1011

Issue Overview: A flaw was found in MariaDB. An authenticated user with permission to use the CONNECT storage engine can exploit an incorrect boundary check when handling DOS table types to write beyond the allocated stack buffer. This flaw could lead to arbitrary code execution or cause the...

PT-2026-122510

Name of the Vulnerable Software and Affected Versions Front End Users WordPress plugin versions prior to 3.2.36 Description Unauthenticated users can manipulate account attributes during registration via front-end forms. This allows them to assign themselves arbitrary membership levels and mark...

Amazon Linux 2 : alsa-lib (ALAS-2026-4041)

The version of alsa-lib installed on the remote host is prior to 1.1.4.1-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4041 advisory. alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113717 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113717 Source advisory: OSV:GHSA-CX28-75Q4-X26Q...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113714 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113714 Source advisory: OSV:GHSA-494P-63J8-28P3...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113718 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113718 Source advisory: OSV:GHSA-394H-QWMC-48PF...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113720 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113720 Source advisory: OSV:GHSA-FC2G-4W5P-6WHM...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-113720 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-113720 Source advisory:...