CVE-2026-3242

In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting...

WordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Charety versions 2.0.2...

CVE-2026-3431 Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including...

CVE-2026-24834 affecting package kata-containers for versions less than 3.19.1.kata2-5

CVE-2026-24834 affecting package kata-containers for versions less than 3.19.1.kata2-5. A patched version of the package is available...

PT-2026-22377

Name of the Vulnerable Software and Affected Versions @fastify/middie versions prior to 9.2.0 Description A flaw exists in @fastify/middie that can lead to authentication or authorization bypass when path-scoped middleware is used, such as with app.use'/secret', auth. This occurs when Fastify...

CVE-2026-2761

Sandbox escape in the Graphics: WebRender component. This vulnerability affects Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

CVE-2026-2800 Spoofing issue in the WebAuthn component in Firefox for Android

Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148...

WordPress ElementsKit Lite plugin < 3.7.9 - Unauthenticated Mailchimp REST Endpoint vulnerability

Unauthenticated Mailchimp REST Endpoint vulnerability discovered by Rahul Karne in WordPress Plugin ElementsKit Elementor addons Lite versions 3.7.9...

CVE-2026-1761 affecting package libsoup for versions less than 3.4.4-12

CVE-2026-1761 affecting package libsoup for versions less than 3.4.4-12. A patched version of the package is available...

PT-2026-21689

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 147.4 Description A flaw exists in Firefox for iOS that could allow malicious scripts to cause a mismatch between the address bar display and the actual web content. This could lead to a user being presented...

CVE-2025-69330

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jthemes Prestige prestige allows Reflected XSS.This issue affects Prestige: from n/a through 1.4.1...

CVE-2025-68531 WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Object Injection.This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through 1.5.6...

CVE-2025-67995 WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through 2.1...

CVE-2026-25307 WordPress XStore Core plugin < 5.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.This issue affects XStore Core: from n/a through 5.7...

CVE-2026-0929 RegistrationMagic < 6.0.7.2 - Subscriber+ Form Creation

The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site...

Mozilla Firefox < 147.0.4

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 147.0.4. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-10 advisory. - Heap buffer overflow in libvpx. This vulnerability affects Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR...

Microsoft Windows Notepad < 11.2510 Command Injection (February 2026)

The Windows 'Microsoft Windows Notepad' app installed on the remote host is prior to version 11.2510. It is, therefore, affected by a command injection vulnerability: - Improper neutralization of special elements used in a command allows an unauthorized attacker to execute code over a network...

CVE-2021-3639 affecting package mod_auth_mellon for versions less than 0.16.0-4

CVE-2021-3639 affecting package modauthmellon for versions less than 0.16.0-4. A patched version of the package is available...

CVE-2026-1484 affecting package glib for versions less than 2.78.6-7

CVE-2026-1484 affecting package glib for versions less than 2.78.6-7. A patched version of the package is available...

CVE-2023-48795 affecting package rust for versions less than 1.90.0-1

CVE-2023-48795 affecting package rust for versions less than 1.90.0-1. An upgraded version of the package is available that resolves this issue...