CVE-2026-100149 WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...

EUVD-2026-91921

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved,...

CVE-2026-92536

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

CVE-2026-95374

An incorrect authorization flaw was found in the Network component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/543464436...

HeartbleedAttack

Heartbleed Attack: Java-Based Attack Demo Overview This repository features Heartbleed.java, a custom Java-based exploit designed to demonstrate the Heartbleed vulnerability CVE-2014-0160 by extracting sensitive data from a vulnerable server IP: 192.168.1.132 running Apache port 443 and Postfix...

CVE-2026-92536

The ProfilePress plugin for WordPress (all versions up to and including 4.17.4 ) is vulnerable to Sensitive Information Exposure via the get_user_profile_structure function. Authenticated attackers with subscriber-level access or higher can extract other users' email addresses, login names, and r...

CVE-2026-92536 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

EUVD-2026-91890

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

CVE-2026-92536 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

CVE-2026-94539

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 3.5.3 . The flaw exists due to insufficient escaping and a lack of sufficient preparation on the user-supplied 'sort_by' p...

TP-LINK - Local File Inclusion

TP-LINK is susceptible to local file inclusion in these products: Archer C5 1.2 with firmware before 150317, Archer C7 2.0 with firmware before 150304, and C8 1.0 with firmware before 150316, Archer C9 1.0, TL-WDR3500 1.0, TL-WDR3600 1.0, and TL-WDR4300 1.0 with firmware before 150302, TL-WR740N...

Fedora 43 : cockpit-machines (2026-4923296720)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4923296720 advisory. Automatic update for cockpit-machines-357-1.fc43. Changelog for cockpit-machines Wed Sep 23 2026 Packit - 357-1 - Harden against local attacks from...

CVE-2026-92536: Improper Control of Generation of Code

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

PT-2026-104488

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get user profile structure. This makes it possible fo...

Fedora 44 : cockpit-machines (2026-57e39fc2fa)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-57e39fc2fa advisory. Automatic update for cockpit-machines-357-1.fc44. Changelog for cockpit-machines Wed Sep 23 2026 Packit - 357-1 - Harden against local attacks from...

CVE-2026-100149: Exposure of Sensitive Information to an Unauthorized Actor

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...

CVE-2022-44311

Description for CVE-2022-44311 html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elmclosetreenodet nodo at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service DoS via a crafted html file. Reproduction T...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Jakub Herman in WordPress Plugin ProfilePress versions = 4.17.4...

EUVD-2026-91789

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

CVE-2026-104994

Versions of Trivy prior to 0.71.0 are vulnerable to a directory traversal issue within Terraform filesystem functions . The root cause occurs when these functions attempt to access pathnames located above the designated scan root. This risk is particularly relevant when performing misconf scannin...