EUVD-2026-53734

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

EUVD-2026-53387

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's dat...

CVE-2026-0931

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart...

CVE-2026-0931 Denial-of-service vulnerability in M-Files Server

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files Server process to crash and fail to restart...

CVE-2026-15210

The CVE-2026-15210 entry concerns the WordPress plugin “OTP Login With Phone Number, OTP Verification” (before version 1.8.71). The vulnerability is that the plugin does not limit OTP verification attempts or invalidate a one-time code after a wrong guess, allowing an unauthenticated user to requ...

CVE-2026-15360 Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database...

OpenSSL 4.0.0 < 4.0.2 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 4.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the 4.0.2 advisory. - Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the...

CVE-2026-16547

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-16293

The CVE concerns the PowerPress Podcasting plugin for WordPress by Blubrry, affected in versions prior to 11.16.11. The underlying issue is improper sanitization/escaping of certain Podcast Episode settings, enabling Stored Cross-Site Scripting by a user with Contributor+ privileges even if unfil...

CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

NPM: undici vulnerable to CRLF Injection via blob-like body 'type' property

NPM: undici vulnerable to CRLF Injection via blob-like body 'type' property vulnerability discovered by ? in WordPress Npm undici versions 6.28.0...

EUVD-2026-52325

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-15254

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...

CVE-2026-59650

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2025-71400

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

GHSA-MJRX-74JH-7XGW Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wm3w-8rrp-j577. This link is maintained to preserve external references. Original Description guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the...

CVE-2026-67341 ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-67353

guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the CookieJar that accepts unlimited Set-Cookie header fields with no size restrictions. Attackers can return many large cookies from a malicious server, causing Guzzle to store excessive data in memory and...

CVE-2026-67305

FreeRDP Windows client (before 3.29.0) has a heap buffer overflow in the clipboard virtual channel (CLIPRDR_FILE_CONTENTS_RESPONSE PDUs) due to lack of validation of the server-provided size against the destination buffer. A malicious RDP server could send a payload larger than requested, causing...

CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...