CVE-2026-14602

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-14226

The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

CVE-2026-14310

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A thread...

CVE-2026-14231

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

CVE-2026-13395

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

CVE-2026-14221

The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and t...

CVE-2026-13145

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

CVE-2026-11782

The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated...

Vulnerabilities are handled in GitLab through GitLab Inc.

GitLab Inc. has addressed several vulnerabilities in GitLab, particularly in versions prior to 19.0.5, 19.1.3, and 19.2.1, including those of the GitLab Enterprise Edition EE. These vulnerabilities concern various aspects of GitLab: - Improper access control, allowing authenticated users to acces...

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than...

CVE-2026-58066

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside...

CVE-2026-58066

Rocket.Chat SAML SSO prior to versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8 and 7.10.14 verify XML signatures but do not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside a v...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

CVE-2026-58046

CVE-2026-58046 affects Plesk, specifically the XML-RPC API. The root cause is improper neutralization, enabling a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, with potential full panel compromise. No remediation details are pro...

CVE-2026-64635

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to...

CVE-2026-64635

CVE-2026-64635 affects Veeam Service Provider Console. An improper handling of the returnUrl parameter in Forgot Password enables an unauthenticated attacker to hijack the password-reset link domain, causing the reset code to be sent to an attacker-controlled host and potentially take over the us...

CVE-2026-17907

A flaw was found in Google Chrome's Network component. A remote attacker could exploit this side-channel information leakage vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to leak sensitive cross-origin data...

CVE-2026-14310 Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A thread...

CVE-2026-14310

The CVE concerns Tutor LMS for WordPress, affecting versions before 4.0.0. The underlying issue is improper access verification for Q&A threads: an authenticated user with subscriber-level access (or higher) who can access any single course can read Q&A threads in other courses and inject replies...

CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...