CVE-2026-27093 WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ovatheme Tripgo tripgo allows PHP Local File Inclusion.This issue affects Tripgo: from n/a through 1.5.6...

CVE-2026-4111 affecting package libarchive for versions less than 3.6.1-9

CVE-2026-4111 affecting package libarchive for versions less than 3.6.1-9. A patched version of the package is available...

CVE-2026-25449

Deserialization of Untrusted Data vulnerability in Shinetheme Traveler allows Object Injection.This issue affects Traveler: from n/a before 3.2.8.1...

CVE-2026-32452

Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fusion Builder: from n/a through 3.15.0...

CVE-2026-26018 affecting package coredns for versions less than 1.11.4-15

CVE-2026-26018 affecting package coredns for versions less than 1.11.4-15. A patched version of the package is available...

CVE-2026-26018 affecting package coredns for versions less than 1.11.1-26

CVE-2026-26018 affecting package coredns for versions less than 1.11.1-26. A patched version of the package is available...

CVE-2026-4092

CVE-2026-4092 affects Google clasp prior to 3.2.0. A path traversal in filenames within a Google Apps Script project can lead to remote code execution, enabling an attacker to write arbitrary files on the host. Affected versions:

CVE-2026-32417

CVE-2026-32417 affects the WordPress Pochipp plugin, versions prior to 1.18.9. The issue is a Missing Authorization vulnerability stemming from incorrectly configured access control, allowing unauthorized access according to the description. The affected component is the Pochipp plugin (pochipp) ...

CVE-2025-47911 affecting package docker-buildx for versions less than 0.14.0-10

CVE-2025-47911 affecting package docker-buildx for versions less than 0.14.0-10. A patched version of the package is available...

CVE-2025-30204 affecting package influxdb for versions less than 2.7.5-13

CVE-2025-30204 affecting package influxdb for versions less than 2.7.5-13. A patched version of the package is available...

CVE-2026-25068 affecting package alsa-lib for versions less than 1.2.9-2

CVE-2026-25068 affecting package alsa-lib for versions less than 1.2.9-2. A patched version of the package is available...

CVE-2025-11065 affecting package opa for versions less than 0.63.0-3

CVE-2025-11065 affecting package opa for versions less than 0.63.0-3. A patched version of the package is available...

EUVD-2026-10783

Substance3D - Stager versions 3.1.7 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2025-68553

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz: from n/a through 2.0.1...

WordPress plugin PowerPack for LearnDash 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

CVE-2026-28413 Products.isurlinportal: Possible open redirect when using more than 2 forward slashes

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?camefrom=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0...

Chamilo 跨站脚本漏洞

Chamilo is an open-source learning management system developed by Chamilo. Versions of Chamilo prior to 1.11.34 contained a cross-site scripting vulnerability. This vulnerability stemmed from insecure file uploads in the social networking functionality, leading to storage-based cross-site scripti...

BentoML < 1.4.36 Arbitrary File Write

The version of the BentoML library installed on the remote host is prior to 1.4.36. It is, therefore, affected by an arbitrary file write vulnerability: - The safeextracttarfile function validates that each tar member's path is within the destination directory, but for symlink members it only...

PT-2026-22985

Name of the Vulnerable Software and Affected Versions Dell Device Management Agent DDMA versions prior to 26.02 Description Dell Device Management Agent DDMA is affected by an Improper Check for Unusual or Exceptional Conditions. A local attacker with low privileges could potentially cause a Deni...

CVE-2026-28352

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this ...