CVE-2026-54185

CVE-2026-54185 – WordPress Cornerstone plugin (

CVE-2026-39582

CVE-2026-39582 affects the WordPress Hitek theme prior to version 1.8.3, with an unauthenticated Local File Inclusion vulnerability in the theme. The CVSSv3.1 score is 8.1 (HIGH), driven by network access, high attack complexity, no privileges required, and impacts to confidentiality, integrity, ...

CVE-2026-35414 affecting package openssh for versions less than 9.8p1-7

CVE-2026-35414 affecting package openssh for versions less than 9.8p1-7. A patched version of the package is available...

CVE-2025-69165 WordPress Choreo theme <= 1.6 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Choreo = 1.6 versions...

NPM: Astro: Host header SSRF in prerendered error page fetch

NPM: Astro: Host header SSRF in prerendered error page fetch vulnerability discovered by ? in WordPress Npm astro versions 6.4.6...

NPM: hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

NPM: hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest vulnerability discovered by ? in WordPress Npm hono versions 4.12.25...

CVE-2026-40793 WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Groundhogg 4.4.1 versions...

CVE-2026-5223 affecting package rust for versions less than 1.75.0-30

CVE-2026-5223 affecting package rust for versions less than 1.75.0-30. A patched version of the package is available...

CVE-2026-42012 affecting package gnutls for versions less than 3.8.13-1

CVE-2026-42012 affecting package gnutls for versions less than 3.8.13-1. An upgraded version of the package is available that resolves this issue...

NPM: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

NPM: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization vulnerability discovered by ? in WordPress Npm fabric versions 7.4.0...

NPM: Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

NPM: Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step vulnerability discovered by ? in WordPress Npm budibase versions 3.39.0...

WordPress Schema & Structured Data for WP & AMP plugin < 1.60 - Unauthenticated Arbitrary Media Upload vulnerability

Unauthenticated Arbitrary Media Upload vulnerability discovered by 0xBassia in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.60...

CVE-2026-20251

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or...

CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls,...

CVE-2026-27145 affecting package golang for versions less than 1.25.11-1

CVE-2026-27145 affecting package golang for versions less than 1.25.11-1. A patched version of the package is available...

CVE-2026-10721 Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7...

CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1

CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-46598 affecting package docker-compose for versions less than 2.27.0-13

CVE-2026-46598 affecting package docker-compose for versions less than 2.27.0-13. A patched version of the package is available...

CVE-2026-25680 affecting package docker-compose for versions less than 2.27.0-13

CVE-2026-25680 affecting package docker-compose for versions less than 2.27.0-13. A patched version of the package is available...

PT-2026-48495

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious classic dashboard that...