CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

CVE-2026-17515 MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

CVE-2026-7753

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-7753 Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the cost-calculator-custom-export-run AJAX action handler CCBExportImport::exportcalculators in all versions up to, and including, 3.6.17. The handler only...

CVE-2026-6639: Missing Authorization

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-20294: Cleartext Transmission of Sensitive Information

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types...

CVE-2026-12762: Insertion of Sensitive Information into Externally-Accessible File or Directory

IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files...

CVE-2026-12000: Missing Authorization

The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core REST endpoints /wp-json/wp/v2/pages, /wp-json/wp/v2/pages/ , /wp-json/wp/v2/posts, and /wp-json/wp/v2/posts/ . This is due to the plugin'...

LLM-Assisted Detection and Repair of Hardware Security Vulnerabilities in Verilog Designs

Hardware designs, like software, are susceptible to bugs that can introduce security vulnerabilities and create opportunities for malicious exploitation. Unlike software vulnerabilities, however, hardware flaws become permanently embedded in silicon after fabrication, making them difficult or...

CVE-2026-20294: Cleartext Transmission of Sensitive Information

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types...

PT-2026-68554

Name of the Vulnerable Software and Affected Versions WPBruiser no- Captcha anti-Spam versions prior to 3.1.44 Description The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to manipulate the resulting object. Thi...

PT-2026-68121

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.73.2 Description The @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, and PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file...

PT-2026-67943

Name of the Vulnerable Software and Affected Versions VikAppointments Service Booking Calendar affected versions not specified Description An unauthenticated SQL injection exists because a parameter controlling the sorting of the public reviews list is used to construct a database query without...

PT-2026-68511

Name of the Vulnerable Software and Affected Versions YITH WooCommerce Zoom Magnifier versions prior to 2.53.0 Description The YITH WooCommerce Zoom Magnifier plugin for WordPress allows unauthenticated attackers to extract sensitive user or configuration data through sensitive information...

PT-2026-68097

Name of the Vulnerable Software and Affected Versions IOTSmartHome affected versions not specified Description The checkCookie function in the 'gui/login.php' endpoint is susceptible to SQL injection. The issue occurs when the system processes the lastLogin cookie using the safe decode function,...

PT-2026-68059

Name of the Vulnerable Software and Affected Versions WP TripAdvisor Review Slider versions prior to 14.4 Description The plugin is subject to a generic SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs due to insufficient escaping...

MAL-2026-11531 Malicious code in @zzzgenesis00/hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9f452c698c4accd69ca2df75854aae3189ecf3dddafc4b62d86403ca3d911f On npm install, scripts.postinstall executes postinstall.js which harvests installer-side secrets and host reconnaissance and transmits them to...

CVE-2026-47622

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successful exploit of this vulnerability might lead to information disclosure...

GHSA-FR6G-7CQ8-FG82 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...

CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wide upsert history instead of being scoped to the requesting user, tenant, or workspace. The response can exceed 100MB an...