PT-2026-124591

TuxCare rebuilt @babel/plugin-transform-react-jsx to address 1 CVE. Fixed in 7.29.0-tuxcare.1...

PT-2026-124464

TuxCare rebuilt @babel/plugin-proposal-decorators to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-124443

TuxCare rebuilt @babel/plugin-proposal-class-properties to address 2 CVEs. Fixed in 7.12.13-tuxcare.3...

PT-2026-115898

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data...

CVE-2026-74923: Exposure of Sensitive Information to an Unauthorized Actor

The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed...

PT-2026-124573

TuxCare rebuilt @babel/plugin-transform-react-display-name to address 1 CVE. Fixed in 7.14.8-tuxcare.1...

Unsafe Dependency Resolution

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Unsafe Dependency Resolution vi...

EUVD-2026-100461

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning...

GHSA-P7V4-VR35-MJ6F containerd CRI plugin: Checkpoint restore bypasses destination security context

Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI...

containerd CRI plugin: Checkpoint restore bypasses destination security context

Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI...

EUVD-2026-98850

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods...

WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Login with phone number versions = 1.8.77...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin HivePress versions = 1.7.32...

WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rodrigo Cabo Igneva Solutions, S.L. in WordPress Plugin Sunshine Photo Cart versions = 3.7.4...

WordPress Search Regex plugin <= 3.5 - Authenticated (Subscriber+) Remote Code Execution vulnerability

Authenticated Subscriber+ Remote Code Execution vulnerability discovered by R3D in WordPress Plugin Search Regex versions = 3.5...

WordPress Theme My Login plugin <= 7.2.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by R3D in WordPress Plugin Theme My Login versions = 7.2.1...

WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MDTF versions = 1.4.0...

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

WordPress Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin <= 1.19 - Sensitive Information Exposure vulnerability

Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin Lightweight Cookie Notice Cookie Banner for Cookie Consent versions = 1.19...