CVE-2026-16985 Squeeze < 1.7.12 - Author+ Arbitrary File Upload

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

EUVD-2026-55014

The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the uploadfiles capability Author and above to write an executable PHP file into the uploads directory and achiev...

CVE-2026-16985

CVE-2026-16985 – Squeeze WordPress plugin (

Photon OS 5.0: Openjdk21 PHSA-2025-5.0-91-0600

An update of the openjdk21 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0600. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Postgresql15 PHSA-2025-5.0-91-0490

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0490. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

ROS-20260810-73-0013

The vulnerabilities of the ngxhttpproxyv2module and ngxhttpgrpcmodule modules in NGINX Plus and NGINX Open Source web servers are related to the execution of operations outside of the buffer in memory. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code or cause...

MiracleLinux 9 : cups-2.3.3op2-39.el9_8 (AXSA:2026-1504:10)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1504:10 advisory. cups: OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network CVE-2026-34980 Tenable has...

Photon OS 5.0: Xz PHSA-2025-5.0-91-0496

An update of the xz package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0496. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Nodejs PHSA-2024-5.0-91-0213

An update of the nodejs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0213. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2026-5.0-91-0913

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0913. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Libtiff PHSA-2023-5.0-91-0039

An update of the libtiff package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0039. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Opencart ecommerce platform contains directory traversal vulnerability

Overview The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded .zip files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. Th...

Photon OS 5.0: Emacs PHSA-2024-5.0-91-0314

An update of the emacs package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0314. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Squid PHSA-2026-5.0-91-0819

An update of the squid package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0819. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Kubernetes PHSA-2023-5.0-91-0043

An update of the kubernetes package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0043. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Keepalived PHSA-2026-5.0-90-0921

An update of the keepalived package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0921. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2025-5.0-91-0458

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0458. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

📄 WordPress 7.0.2 Code Execution / Cross Site Scripting

A proof of concept exploit for a reflected cross site scripting vulnerability in WordPress version 7.0.2. The vulnerability results from a parser differential between PHP striptags and WordPress KSES processing of usernames supplied to wp-login.php, allowing attacker-controlled markup to survive...

PT-2026-69857

Name of the Vulnerable Software and Affected Versions use-context-selector affected versions not specified Description Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits that executed remote attacker-controlled code on developer machines during npm...