PT-2026-49506

Unauthenticated Broken Access Control in Knit Pay = 9.4.0.0 versions...

PT-2026-49351

Unauthenticated Cross Site Scripting XSS in Okay Toolkit = 2.3 versions...

PT-2026-49379

Contributor PHP Object Injection in Post Duplicator = 3.0.10 versions...

PT-2026-49373

Subscriber Broken Authentication in FunnelKit Automations = 3.7.3 versions...

PT-2026-49359

Unauthenticated Bypass Vulnerability in WpTravelly = 2.1.7 versions...

PT-2026-49644

Name of the Vulnerable Software and Affected Versions GEO my WordPress versions prior to 4.5.6 Description Unauthenticated SQL Injection allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them to view data they are not normally able to...

CVE-2026-40769: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field = 1.0.6 versions...

CVE-2026-39468: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework = 5.11.1 versions...

CVE-2026-39449: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Contact Form to Any API = 3.0.3 versions...

Braille support module Privilege Escalation

The vulnerability of the Braille support module in the text-to-speech application for blind and visually impaired users like Narrator is related to the use of an unreliable search path. Exploiting this vulnerability can allow attackers to gain increased privileges...

CVE-2026-11769 Operator - Namespaced User Path Traversal

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating...

MAL-2026-5726 Malicious code in ecto_module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e66c690abd94ee498cd359eb076451c0f6ea3956d8221616bbf8990d35a38c5 On npm install, the package's preinstall hook node index.js reads /flag.txt falling back to execSync'cat /flag' and transmits the captured contents i...

[SECURITY] Fedora 44 Update: weasyprint-69.0-1.fc44

WeasyPrint can render HTML and CSS to PDF. It aims to support web standards for printing...

PT-2026-49077

Name of the Vulnerable Software and Affected Versions WP Ticket versions prior to 6.0.5 Description The WP Ticket plugin for WordPress allows unauthenticated attackers to extract sensitive information from the database. The issue occurs during unauthenticated front-end searches when the plugin...

CVE-2026-9062: Improper Limitation of a Pathname to a Restricted Directory

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...

kiro-cybersecurity-skills

CyberSecurity Skills A collection of 15 security workflows co...

CVE-2025-7019 Avast antivirus stack overflow when scanning a malformed Office Open XML file

Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the PATCH /server/id process. An attacker can gain unauthorized access to another user's DDNS profile context by storing a nonexistent ddnsprofiles ID for a server they own, which is later resolved if another...

Malicious code in claudechor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9cbb36cf7ed82685830b5d3a2b341bff9ef86e2688842d1f54259b2b6fb533 The package's bin entry reads installer-owned Claude credential files /.claude/.credentials.json and /.claude.json — written by Anthropic's official...

CVE-2026-24618 WordPress Hash Elements plugin <= 1.5.4 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements allows Retrieve Embedded Sensitive Data. This issue affects Hash Elements: from n/a through 1.5.4...