PT-2026-124464

TuxCare rebuilt @babel/plugin-proposal-decorators to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CVE-2026-104001: Improper Control of Generation of Code

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running...

Unsafe Dependency Resolution

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Unsafe Dependency Resolution vi...

EUVD-2026-100461

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning...

GHSA-P7V4-VR35-MJ6F containerd CRI plugin: Checkpoint restore bypasses destination security context

Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI...

containerd CRI plugin: Checkpoint restore bypasses destination security context

Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI...

EUVD-2026-98850

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods...

WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Login with phone number versions = 1.8.77...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin HivePress versions = 1.7.32...

WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rodrigo Cabo Igneva Solutions, S.L. in WordPress Plugin Sunshine Photo Cart versions = 3.7.4...

WordPress Search Regex plugin <= 3.5 - Authenticated (Subscriber+) Remote Code Execution vulnerability

Authenticated Subscriber+ Remote Code Execution vulnerability discovered by R3D in WordPress Plugin Search Regex versions = 3.5...

WordPress Theme My Login plugin <= 7.2.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by R3D in WordPress Plugin Theme My Login versions = 7.2.1...

WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MDTF versions = 1.4.0...

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

WordPress Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin <= 1.19 - Sensitive Information Exposure vulnerability

Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin Lightweight Cookie Notice Cookie Banner for Cookie Consent versions = 1.19...

WordPress Mang Board plugin <= 2.4.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Mang Board WP versions = 2.4.4...

Discourse Doc Categories Plugin Information Leak Vulnerability

Discourse Doc Categories Plugin has a vulnerability related to information leakage. This vulnerability arises from the indexing refresh process, which does not validate the authorization of viewers when parsing links to topics with restricted categories. As a result, users who have access to the...

activity-log.com WP Sessions Time Monitoring Full Automatic Cross-Site Script Vulnerability

activity-log.com WP Sessions Time Monitoring Full Automatic version 1.1.5 and earlier has a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping for parameters such as action as well as function, plugin, posttype, poststatus, ids,...

HivePress – Business Directory, Listing & Classified Ads Plugin Cross-site Scripting Vulnerability

HivePress – Business Directory, Listings & Classified Ads Plugin 1.7.32 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'message' parameter input and inadequate escaping of output data. It may allow authenticated attackers...