WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by lqc in WordPress Plugin Super Socializer versions = 7.14.5...

Vatican&#8217;s Click To Pray app exposed personal data from 700,000 users

A prayer app launched by Pope Francis in 2019 contained a security flaw that exposed the personal information of hundreds of thousands of users before it was finally fixed this year. The app, Click To Pray, was developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer...

WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin AffiliateWP versions = 2.35.0...

WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.10...

WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by qdtad in WordPress Plugin AIWU versions = 1.5.6...

CVE-2026-57215

A flaw was found in RabbitMQ, a messaging and streaming broker. This vulnerability allows an attacker to establish persistent foreign bindings to reply-to destinations. This occurs because temporary queues are not properly removed, leaving behind active routing entries. This can lead to...

CVE-2026-13161 TrueBooker <= 1.2.2 - Unauthenticated SQL Injection

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...

CVE-2026-13161

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...

SUSE-SU-2026:22997-1 Security update for hawk-apiserver

This update for hawk-apiserver fixes the following issues: Changes in hawk-apiserver: - Bump ClusterLabs/go-pacemaker v0.0.0-20260609131737-256130b189e0 bsc1267454 Version 0.1.0+git.1773234993.db3c82f: handle /cib/live/primitives//edit in hawk-apiserver - Bump github.com/stretchr/testify.v1.11.0...

CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

UBUNTU-CVE-2024-14041

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

MAL-2026-11119 Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...

EUVD-2024-55702

In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM CRYSTALS-Kyber routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An...

CVE-2026-12741 WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'formdatas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by daroo in WordPress Theme Betheme versions = 28.4.2...

ziti v2.0.2

OpenZiti OpenZiti is an open-source zero-trust networking platform that makes network services invisible to unauthorized users. Every connection, whether from a user, a service, a device, or a workload, is authenticated with cryptographic identity, authorized by policy, and encrypted end-to-end...

CVE-2026-16585

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

erlang/otp: erts: otp: Erlang/OTP: Denial of Service via integer underflow in ETF decoding

A flaw was found in Erlang/OTP. A remote attacker can exploit an integer underflow vulnerability in the External Term Format ETF decoder, specifically within the binarytoterm function. By sending a specially crafted ETF payload with a zero-length BITBINARYEXT tag, the attacker can trigger an...

EUVD-2026-49658

Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...

PT-2026-65603

Name of the Vulnerable Software and Affected Versions IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 Description A remote authenticated attacker can execute arbitrary code due to unquoted shell interpolation, a process where input is improperly handled when passed to a system shell, allowing...