CVE-2026-75981

TranslatePress ≤3.2.5 has an unauthenticated stored XSS in translate_page() (class-translation-render.php:538-539), where plain-text markers #!trpst#/#!trpen# survive wp_kses and are rewritten to , enabling execution in visitors' browsers; CVSS 7.2 HIGH. Exploitation in the wild is not reported ...

PT-2026-72173

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode handle in fwnode init If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroi...

MAL-2026-13412 Malicious code in @apicity/meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581 dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload ho...

CVE-2025-15039

The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...

CVE-2025-11850

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-15039

CVE-2025-15039 concerns the Conditional Authentication (Adaptive Authentication) script in multiple WSO2 products. The flaw is that the script does not properly enforce completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configure...

EUVD-2025-210627

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-11850

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-11850 Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

CVE-2025-11850

CVE-2025-11850 affects the WSO2 Identity Server: when secondary user stores are configured, the implicit-association resolver can initialize from a secondary store and bypass the primary store during search/uniqueness checks, allowing a subject to be linked to an unintended local account if the s...

CVE-2024-6832 Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

CVE-2024-6832

CVE-2024-6832 describes an account locking failure in multiple WSO2 products where the lockout is not triggered if secondary user stores are inaccessible. The root cause is that the system does not maintain a consistent lockout state across all configured stores, enabling an attacker to perform r...

MAL-2026-11573 Malicious code in @nebula.js/sn-distributionplot (npm)

npm/@nebula.js/sn-distributionplot is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/channel-transformer (npm)

npm/@onereach/channel-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-67334

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67334

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

EUVD-2026-51828

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-67334

CVE-2026-67334 affects better-auth versions before 1.6.11. When secondaryStorage is configured and storeSessionInDatabase is false, deleting users via admin, anonymous, or SCIM endpoints fails to delete cached sessions, allowing attackers to reuse deleted user session tokens for up to seven days ...