WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

Malicious code in tinkoff-fb-service-prefill-profile-contact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f On require of the package's main entry, vendor.js downloads a platform-specific executable from anonymous Cloudflare Workers hosts under...

MAL-2026-12142 Malicious code in beaver-ui-ai-chat-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18143c270ff7461d38c50147f24245f346aecf7cc07e4883590c9c677b13809 Package is advertised as a UI chat layout toolkit but its index.js unconditionally requires a setup.js that side-loads a 77 KB module internally...

CVE-2026-69248 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, openstack-glance-2025.2, openstack-nova-2026.1, kserve, openstack-glance-2026.1, apache-beam-python-3.13-sdk, dbt-snowflake, vllm-openai-cuda-13.0, openstack-nova-2025.1, az, mlflow, apache-beam-python-3.12-sdk, openstack-glance-2025.1,...

WordPress WP Activity Log Premium plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log Premium versions = 5.6.4...

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

CVE-2026-71208

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-6972

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-11969

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs' Parameter in all versions up to, and including, 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...

CVE-2026-11920

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

UBUNTU-CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64578 ksmbd: validate compound request size before reading StructureSize2

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...

CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

[SECURITY] [DLA 4717-1] linux security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4717-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort August 05, 2026 https://wiki.debian.org/LTS -...

WordPress Pronamic Pay plugin <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Afan, moonge in WordPress Plugin Pronamic Pay versions = 10.1.0...

CVE-2026-11920

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...