CVE-2026-5391 LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

CVE-2026-57818 Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

EUVD-2026-53862

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...

CVE-2026-61466 Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...

CVE-2026-61466

The Apache CXF services framework, specifically the org.apache.cxf:cxf-rt-rs-security-oauth2 package, contains a vulnerability in its OAuth2 Dynamic Client Registration endpoint. The root cause is that the authorization server accepts and stores the scope value from the client registration reques...

EUVD-2026-53859

Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks issuer/subject/audience/time and subjwk binding, enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in...

Important: Red Hat Security Advisory: OpenShift Source To Image 1.6.3

OpenShift Source To Image 1.6.3 Release Release of OpenShift Source To Image 1.6.3...

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced Custom Fields: Font Awesome Field versions = 6.1.2...

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plugins Garbage Collector Database Cleanup versions = 0.14...

WordPress YOP Poll plugin 7.0.0-7.0.6 - Unauthenticated Vote Restriction Bypass vulnerability

Unauthenticated Vote Restriction Bypass vulnerability discovered by Melina Lentini M3l3n in WordPress Plugin YOP Poll versions 7.0.0-7.0.6...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin TranslatePress versions = 3.2.6...

WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Subscribe to Comments versions = 2.3.1...

WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by TurboNexic in WordPress Plugin SureCart versions = 4.6.2...

WordPress Football Pool plugin <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting vulnerability

Authenticated Subscriber+ Reflected Cross-Site Scripting vulnerability discovered by whitesector in WordPress Plugin Football Pool versions = 2.13.4...

WordPress LightSync Pro – Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock plugin <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin LightSync Pro versions = 2.1.6...

WordPress Independent Analytics – WordPress Analytics Plugin plugin <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Independent Analytics - Google Analytics Alternative for WordPress versions = 2.15.0...

CVE-2026-19034 Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

WordPress Login & Register Forms plugin < 3.2.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Login/Signup Popup versions 3.2.5...

RHSA-2026:50770 Red Hat Security Advisory: python3.12 security update

Bulletin has no description...

CVE-2026-64958 Apache CXF: Denial of service via message header attachments

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue...