WordPress NP Quote Request for WooCommerce plugin 2.0-2.4.15 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Murad Islamzada in WordPress Plugin NP Quote Request for WooCommerce versions 2.0-2.4.15...

CVE-2026-93528 NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

PT-2026-97490

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

PT-2026-97201

Name of the Vulnerable Software and Affected Versions NP Quote Request for WooCommerce WordPress plugin versions prior to 2.4.16 Description An issue exists where the software fails to verify order ownership before rendering order details. This allows unauthenticated attackers to view the orders ...

CVE-2026-93528: Exposure of Sensitive Information to an Unauthorized Actor

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

CVE-2026-95602: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

Malicious Package

Overview @tesla-insurance/vinless-quote is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

MAL-2026-16378 Malicious code in @tesla-insurance/vinless-quote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...

CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

EUVD-2026-84070

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-45381

Tautulli is a Python-based monitoring and tracking tool for Plex Media Server . In versions prior to 2.17.2 , the /search endpoint inserts a user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but no...

PT-2026-96227

Name of the Vulnerable Software and Affected Versions Tautulli versions prior to 2.17.2 Description The /search endpoint inserts a user-controlled query parameter into a JavaScript string within the data/interfaces/default/search.html file. The application uses manual escaping that fails to handl...

CVE-2026-92701: Origin Validation Error

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS Intel TDX verification path does not copy the expected current-session freshness value into the TDX quote-body...

Parallels Desktop < 27.0.0 Local Privilege Escalation (macOS)

The version of Parallels Desktop installed on the remote macOS host is prior to 27.0.0. It is, therefore, affected by a privilege escalation vulnerability: - Parallels Desktop runs prldispservice as root. Local clients reach it on the world-writable socket /var/run/prldispservice.socket...

GHSA-VFMF-Q6X9-CW96 Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Detector: system/src/Grav/Common/Security.php:290, the onevents regex, run via patternMatches :315-330. - The onevents pattern at HEAD: "'??:\s\x00-\x20"'/|"^""|'^''on\sa-z+\s=iu - Sole save-time guard for...

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Detector: system/src/Grav/Common/Security.php:290, the onevents regex, run via patternMatches :315-330. - The onevents pattern at HEAD: "'??:\s\x00-\x20"'/|"^""|'^''on\sa-z+\s=iu - Sole save-time guard for...

CVE-2026-55692

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled,...

CVE-2026-55692

The EmbedVideo Extension (a MediaWiki extension by StarCitizenWiki) prior to 4.1.0 is vulnerable to stored XSS via the data-mw-iframeconfig attribute. When the default $wgEmbedVideoRequireConsent setting is enabled, EmbedHtmlFormatter.php embeds JSON from AbstractEmbedService.php into an HTML att...

Security Bulletin: Multiple security vulnerabilities found and remediated in IBM webMethods Managed File Transfer

Summary IBM webMethods Managed File Transfer is vulnerable to multiple issues in third-party JavaScript libraries used by its web user interface. The Axios HTTP client is susceptible to prototype pollution attacks that could allow an attacker to intercept or hijack HTTP transport, and to stream...