PT-2026-124581

TuxCare rebuilt @babel/plugin-transform-react-display-name to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-124528

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-124532

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.16.7-tuxcare.2...

PT-2026-124533

TuxCare rebuilt @babel/plugin-proposal-optional-chaining to address 1 CVE. Fixed in 7.16.7-tuxcare.3...

PT-2026-124510

TuxCare rebuilt @babel/plugin-proposal-numeric-separator to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-124576

TuxCare rebuilt @babel/plugin-transform-react-display-name to address 1 CVE. Fixed in 7.18.9-tuxcare.2...

PT-2026-124547

TuxCare rebuilt @babel/plugin-transform-flow-strip-types to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

PT-2026-124512

TuxCare rebuilt @babel/plugin-proposal-numeric-separator to address 1 CVE. Fixed in 7.16.7-tuxcare.2...

PT-2026-115898

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data...

PT-2026-124491

TuxCare rebuilt @babel/plugin-proposal-nullish-coalescing-operator to address 1 CVE. Fixed in 7.16.7-tuxcare.2...

PT-2026-124503

TuxCare rebuilt @babel/plugin-proposal-numeric-separator to address 1 CVE. Fixed in 7.16.7-tuxcare.1...

PT-2026-124442

TuxCare rebuilt @babel/plugin-proposal-class-properties to address 1 CVE. Fixed in 7.12.13-tuxcare.1...

PT-2026-115476

Name of the Vulnerable Software and Affected Versions OTP Login & Register Woocommerce WordPress plugin versions prior to 2.7.3 Description An issue exists where one-time-password verification attempts are not adequately limited. The attempt limit is tracked against a value supplied by the client...

PT-2026-115579

Name of the Vulnerable Software and Affected Versions MAIO WordPress plugin versions prior to 7.3.22 Description Insufficient access restrictions to analytics data allow unauthenticated attackers to retrieve the stored crawl-analytics log. This occurs because the plugin treats a credential value...

CVE-2026-104932: Deserialization of Untrusted Data

The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replaceall function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain...

PT-2026-124550

TuxCare rebuilt @babel/plugin-transform-flow-strip-types to address 1 CVE. Fixed in 7.16.7-tuxcare.2...

PT-2026-124548

TuxCare rebuilt @babel/plugin-transform-flow-strip-types to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...

PT-2026-124561

TuxCare rebuilt @babel/plugin-transform-object-assign to address 1 CVE. Fixed in 7.12.18-tuxcare.2...

PT-2026-124574

TuxCare rebuilt @babel/plugin-transform-react-display-name to address 1 CVE. Fixed in 7.12.18-tuxcare.1...

PT-2026-115909

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc info plugin could be confused by a query containing embedded null bytes. Reading information schema.query cache info after such a query was cached could...