CVE-2026-112868 WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113725 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113725 Source advisory: OSV:GHSA-VXJ4-Q4G9-CRJ7...

UBUNTU-CVE-2026-112947

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...

EUVD-2026-105135

Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113726 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113726 Source advisory: OSV:GHSA-5VJQ-RRRF-7H2Q...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113732 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113732 Source advisory: OSV:GHSA-C947-3PG5-GM8Q...

Roundcube Webmail Project Roundcube Webmail authorization issue vulnerability

The Roundcube Webmail project contains an authorization issue vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from improper authorization in the Modoboa driver used by the password plugin; it fails to match authenticated users and instead retrieves t...

Roundcube Webmail Project Roundcube Webmail Cross-site Scripting Vulnerability

The Roundcube Webmail project contains a cross-site scripting vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because the error messages returned by the password driver in the password plugin are concatenated into user messages without proper HTML...

Exploit for CVE-2026-52887

nocobase-cve-2026-52887 NocoBase security research and exploi...

WordPress CMP – Coming Soon & Maintenance plugin 4.1.19-4.1.20 - Unauthenticated Maintenance Mode Bypass vulnerability

Unauthenticated Maintenance Mode Bypass vulnerability discovered by Sanjeev Kumar in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.19-4.1.20...

WordPress Wava Payment Plugin plugin 0.3.1-0.3.9 - Unauthenticated Merchant Credential Overwrite vulnerability

Unauthenticated Merchant Credential Overwrite vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Wava Payment versions 0.3.1-0.3.9...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.6 Plugin Catalog GA plugins release.

Red Hat Developer Hub 1.10.6 Plugin Catalog GA plugins release. Red Hat Developer Hub RHDH is extensible by the plugins included herein...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-97687 DESCRIPTION: urllib3 is an HTTP client...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-80179, CVE-2026-84185, CVE-2026-92091)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-80179 DESCRIPTION: A flaw was found in jwcrypto...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-84185)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-84185 DESCRIPTION: A flaw was found in the...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-80179)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-80179 DESCRIPTION: A flaw was found in jwcrypto...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-59890)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-59890 DESCRIPTION: setuptools is a package that...

htb-makesense-poc

HTB · MakeSense — PoC Proof-of-concept per la macchina Make...

CVE-2020-3996 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-alicloud, velero-plugin-for-alicloud-fips...

CVE-2026-85683

The Jane Menu WordPress plugin, in versions prior to 1.5.1 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a lack of capability or nonce checks on a form handler accessible by unauthenticated users, which allows them to bind any published page to a remote ...