WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Alfath Marchdika Cahyatullah in WordPress Plugin AfterShip Tracking versions = 1.18.1...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability

Payment Bypass vulnerability discovered by Alexis Lafontaine in WordPress Plugin SMEPay: UPI Gateway for WooCommerce versions = 1.0.5...

WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin AI for SEO versions = 2.4.2...

CVE-2026-31221

A flaw was found in PyTorch-Lightning. This vulnerability, categorized as insecure deserialization CWE-502, exists in the checkpoint loading mechanism. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, which, when loaded by the LightningModule.loadfromcheckpoi...

CVE-2026-71559

CVE-2026-71559 describes a Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory. The issue allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, triggering an uncaught panic. Affected versions are 0.16.0 be...

EUVD-2026-54422

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71558

Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to b...

CVE-2026-71558

CVE-2026-71558 describes a heap type confusion in Apache Fory C++ during polymorphic smart-pointer deserialization. A crafted input can bypass type compatibility checks, causing an object of an incompatible type to be treated as the declared base type, potentially leading to undefined behavior an...

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xManticore in WordPress Plugin Profile Extra Fields by BestWebSoft versions = 1.3.5...

EUVD-2026-54421

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path...

CVE-2026-66491

CVE-2026-66491 affects the Joomla extension phoca.cz Phoca Commander (versions 1.0.0–6.1.3). The issue is an improper limitation of paths in the getSource function, enabling an arbitrary file read. The CVSS v4 metrics indicate a high severity (8.2) with network attack vector, low attack complexit...

CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability...

CVE-2026-66493

CVE-2026-66493 affects the Joomla extension Phoca Commander (phoca.cz) versions 1.0.0 through 6.1.3. The issue is a path traversal vulnerability caused by improper limitation of paths for delete, copy, and move actions. The CVSS data indicates NETWORK access with low complexity and high privilege...

Security Bulletin: due to the use of Apache Log4j, IBM Transformation Extender Advanced is vulnerable to hostname verification bypass and log injection via CRLF sequences

Summary Apache Log4j is used by IBM Transformation Extender Advanced also known as IBM Standards Processing Engine as part of common utility helpers. Apache Log4j has been updated to address CVE-2026-34477 which causes hostname verification bypass and CVE-2026-34478 which causes log injection via...

WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Evan NR in WordPress Plugin Salon booking system versions = 10.30.26...

WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin If-So Dynamic Content Personalization versions = 1.10...

UBUNTU-CVE-2026-12261

A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...