ALPINE-CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-59327

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-15153

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

UBUNTU-CVE-2026-58043

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...

CVE-2026-13330

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

WordPress BookingPress Pro plugin < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering vulnerability

Unauthenticated Customer PII Disclosure and Booking Tampering vulnerability discovered by Kolja Zuelsdorf in WordPress Plugin BookingPress Appointment Booking Pro versions 5.7.3...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

openssh security, bug fix, and enhancement update

An update is available for openssh. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSH is an SSH protocol implementation supported by a number of Linux, UNI...

CVE-2026-13344

The CVE concerns the Essential Addons for Elementor WordPress plugin: versions before 6.6.10 are vulnerable. The bug is in the Pricing Table widget title; the HTML tag name is not validated before output, enabling Stored XSS via the title for users with Contributor-level access and above. When an...

CVE-2026-14305 WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

CVE-2026-13330 Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

CVE-2026-13143

The CVE-2026-13143 entry concerns the WP Travel WordPress plugin before 11.8.1. Vulnerability: it does not verify PayPal Instant Payment Notifications via the PayPal post-back handshake before marking a booking as paid, enabling an unauthenticated actor to forge a notification that flips any pend...

CVE-2026-12500 WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option the public...

EUVD-2026-51001

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-15382 Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-15240 Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

EUVD-2026-50996

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account,...

CVE-2026-12687

The CVE describes a vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.8 where the front-end registration does not restrict which group an anonymous visitor may join. This allows unauthenticated users to register directly into privileged groups and receive that group’s confi...

CVE-2026-14592

The CVE-2026-14592 entry concerns the WP Real IP-based Access Control WordPress plugin (up to version 1.3.1). The root cause is that the plugin does not perform any capability or nonce checks before storing an option value and does not escape that value on output on the settings page, enabling un...

EUVD-2026-50985

The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...