WordPress Theme My Login plugin <= 7.2.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by R3D in WordPress Plugin Theme My Login versions = 7.2.1...

WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MDTF versions = 1.4.0...

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78660 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9

CVE-2026-78669 affecting package sriov-network-device-plugin for versions less than 3.7.0-9. A patched version of the package is available...

WordPress Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin <= 1.19 - Sensitive Information Exposure vulnerability

Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin Lightweight Cookie Notice Cookie Banner for Cookie Consent versions = 1.19...

WordPress Mang Board plugin <= 2.4.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Mang Board WP versions = 2.4.4...

Discourse Doc Categories Plugin Information Leak Vulnerability

Discourse Doc Categories Plugin has a vulnerability related to information leakage. This vulnerability arises from the indexing refresh process, which does not validate the authorization of viewers when parsing links to topics with restricted categories. As a result, users who have access to the...

activity-log.com WP Sessions Time Monitoring Full Automatic Cross-Site Script Vulnerability

activity-log.com WP Sessions Time Monitoring Full Automatic version 1.1.5 and earlier has a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping for parameters such as action as well as function, plugin, posttype, poststatus, ids,...

HivePress – Business Directory, Listing & Classified Ads Plugin Cross-site Scripting Vulnerability

HivePress – Business Directory, Listings & Classified Ads Plugin 1.7.32 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'message' parameter input and inadequate escaping of output data. It may allow authenticated attackers...

MariaDB Server Authorization Issue Vulnerability

MariaDB Server versions prior to 10.6.1 and 10.6.28, 10.11.1 and 10.11.19, 11.4.1 and 11.4.13, 11.8.1 and 11.8.9, 12.3.1 and 12.3.3, and 13.0.1 and 13.0.2 have a vulnerability related to authorization. This vulnerability stems from the fact that UDFs jsonfile, bsonfile, jfilemake, bfilemake, and...

Astra Linux – vulnerability in rabbitmq-server

RabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior to version 3.8.17, adding a new user via the management UI could result in the user’s name being displayed in a confirmation message due to improper sanitization of tags. This might allow JavaScript code execution within the...

Astra Linux – Vulnerability in the 389-DS-base

A flaw was discovered in the ‘deref’ plugin of 389-ds-base, where it could use the ‘search’ permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes...

Astra Linux – Vulnerability in ktexteditor, Kate

The LSP Language Server Protocol plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 attempts to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will attempt to run the LSP server binary in the directory of the...

Astra Linux – vulnerability in rabbitmq-server

Pivotal RabbitMQ versions prior to 3.7.21 in 3.7.x and prior to 3.8.1 in 3.8.x, as well as RabbitMQ for Pivotal Platform versions prior to 1.16.7 in 1.16.x and prior to 1.17.4 in 1.17.x, contain a web management plugin vulnerable to a denial-of-service attack. The “X-Reason” HTTP header can be...

Astra Linux – Vulnerability in Zabbix

The Zabbix Agent 2 smartctl plugin does not properly sanitize the parameters of the smart.disk.get command, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0, this allows for remote code execution...

Astra Linux – vulnerability in strongswan

StrongSwan versions prior to 5.9.8 allow remote attackers to cause a denial of service in the revocation plugin by sending a specially crafted end-entity and intermediate CA certificate containing a CRL/OCSP URL pointing to a server under the attacker’s control that fails to respond properly; for...

600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a maliciou...

WordPress Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Suphakit Phrmduang TORTY in WordPress Plugin WP Dark Mode versions = 5.3.17...

CVE-2026-84659

A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows an attacker to bypass security restrictions by disabling the global script sandbox. By exploiting a missing permission check through Stapler data binding, an attacker can execute arbitrary code, potentially...

CVE-2026-8145

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'processregistration' due to missing validation on the 'wholesalexregistrationrole' parameter. This...