EUVD-2026-57895

Unauthenticated Local File Inclusion in Foton Core = 1.1.1 versions...

CVE-2026-19038

A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.ts of the component screenshotelement Tool. Such manipulation of the argument outputname leads to path traversal. The attack can be execute...

CVE-2026-19038

CVE-2026-19038 affects MonomythDevelopment la-forge-mcp 1.0.0, specifically the screenshotElement function in src/index.ts of the screenshot_element Tool. The issue arises from manipulation of the argument output_name, enabling path traversal. The vulnerability is exploitable remotely via a netwo...

CVE-2026-19038 MonomythDevelopment la-forge-mcp screenshot_element Tool index.ts screenshotElement path traversal

A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.ts of the component screenshotelement Tool. Such manipulation of the argument outputname leads to path traversal. The attack can be execute...

EUVD-2026-53173

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

CVE-2026-6627

WPFormify – Stripe Payments with Form and Checkout plugin for WordPress: CVE-2026-6627, all versions

CLSA-2026-1774743813 TuxCare security update for hawk (5 CVEs)

TuxCare rebuilt hawk to address 5 CVEs. Fixed in 1.1.1-tuxcare.1...

CLSA-2026-1772583196 TuxCare security update for ws (5 CVEs)

TuxCare rebuilt ws to address 5 CVEs. Fixed in 1.1.1-tuxcare.1...

CVE-2026-59528

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

CVE-2026-59528 WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...

EUVD-2026-48135

Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...

CVE-2026-14501 Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions...

SUSE-SU-2026:3074-1 Security update for libssh2_org

This update for libssh2org fixes the following issue Security changes: - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. Other changes: - rebuild libssh2org against openssl 1.1.1, enabling ed25519 support. bsc1227490...

Security update for sccache

This update for sccache fixes the following issue CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270206. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains through the unauthenticated local API exposed in proxy mode, which accepts cross-origin requests due to a permissive CORS policy and lack of authentication. An attacker can achieve...

OPENSUSE-SU-2026:11204-1 ruby4.0-rubygem-uri-1.1.1-1.1 on GA media

These are all security issues fixed in the ruby4.0-rubygem-uri-1.1.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-12349

The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in versions up to, and including, 1.1.1. This is due to missing authorization and capability checks on the addcustomsidebar and removecustomsidebar AJAX handlers, both of which are...

CVE-2026-12349

The CVE-2026-12349 entry concerns the WordPress plugin Premium Addons for KingComposer (versions up to and including 1.1.1). It describes missing authorization and capability checks on two AJAX handlers, add_custom_sidebar() and remove_custom_sidebar(), which are exposed via wp_ajax_nopriv_* and ...

EUVD-2026-40252

The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in versions up to, and including, 1.1.1. This is due to missing authorization and capability checks on the addcustomsidebar and removecustomsidebar AJAX handlers, both of which are...