WordPress plugin OneSignal – Web Push Notifications 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-32160

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-32158

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-32159

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-26167

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-26172

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

MAL-2026-2687 Malicious code in com.baogong.app_push_permission (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93345e918d93e3cd492384a72e95c8e9ce9cafec610ce022b3b19493edb68780 The package com.baogong.apppushpermission was found to contain malicious code. Source: ghsa-malware...

Malicious code in @jesusvizcaino2021/com.baogong.app-push-permission (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 457170b51d87c7f84644a72a71a9979508a99061e7e8fdee3aa8c2e170493b12 The package @jesusvizcaino2021/com.baogong.app-push-permission was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2916 Malicious code in @jesusvizcaino2021/com.baogong.app-push-permission (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 457170b51d87c7f84644a72a71a9979508a99061e7e8fdee3aa8c2e170493b12 The package @jesusvizcaino2021/com.baogong.app-push-permission was found to contain malicious code. Source: ossf-package-analysis...

curl: lib/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)

Summary: settransferurl in lib/http2.c validates the :scheme pseudo-header of PUSHPROMISE frames only when !viasslconn — a guard added by commit 2e8c922a to block non-TLS connections from accepting TLS-scheme pushes. The symmetric case was not addressed: over TLS, viasslconn is TRUE, the guard at...

EUVD-2026-22546

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

EUVD-2026-22549

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

EUVD-2026-22547

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

EUVD-2026-22406

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

EUVD-2026-22396

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-32158

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-32159

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-32160

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-26172

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-26167

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...