CVE-2026-52696

Unauthenticated Sensitive Data Exposure in JetBlog = 2.4.8 versions...

ALPINE-CVE-2026-34356

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

SUSE CVE-2026-44059

A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data, or cause a minor service disruption...

OpenSource-WorkShop Connect-CMS code injection vulnerability

OpenSource-WorkShop Connect-CMS is a content management system used by the OpenSource-WorkShop company, designed for easy website creation. Versions of OpenSource-WorkShop Connect-CMS prior to 1.41.0 and 2.41.0 contain a code injection vulnerability. This vulnerability stems from issues with the...

EUVD-2026-11835

Server-Side Request Forgery SSRF vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer allows Server Side Request Forgery.This issue affects Embed PDF Viewer: from n/a through = 2.4.7...

CVE-2026-1774

The CASL Ability library (versions 2.4.0 through 6.7.4) is vulnerable to a prototype pollution vulnerability. The flaw exists in the rulesToFields() function within the extra module, specifically due to a lack of sanitization in the setByPath() method. This allows attackers to inject arbitrary pr...

PT-2026-4221

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in pavothemes Triply triply allows PHP Local File Inclusion.This issue affects Triply: from n/a through = 2.4.7...

CVE-2025-58899

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Frame frame allows PHP Local File Inclusion.This issue affects Frame: from n/a through = 2.4.0...

CVE-2025-65082

The Apache HTTP Server versions 2.4.0 through 2.4.65 are vulnerable to an Improper Neutralization of Escape, Meta, or Control Sequences vulnerability (CWE-150). The root cause is that environment variables defined via the Apache configuration can unexpectedly supersede variables calculated by the...

WordPress Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin <= 2.4.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Cryptocurrency Token, Launchpad Presale, ICO & IDO, Airdrop by TokenICO versions = 2.4.7...

PT-2025-45277

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Josh Kohlbach WooCommerce Store Toolkit woocommerce-store-toolkit allows PHP Local File Inclusion.This issue affects WooCommerce Store Toolkit: from n/a through = 2.4.3...

CVE-2025-60101

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through = 2.4.2...

WordPress GutenKit Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Prissy in WordPress Plugin GutenKit versions = 2.4.2...

GNU C Library security vulnerabilities

The GNU C Library is an open source, free C language compiler from the GNU community released under the LGPL license. A security vulnerability exists in GNU C Library versions 2.4 through 2.41, which stems from a double release in the regcomp function on certain allocation failures, which may...

CVE-2024-32124

An improper access control vulnerability CWE-284 in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authenticated read-only attacker to alter logs via a crafted HTTP request...

WordPress WP Ride Booking plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin WP Ride Booking versions = 2.4...

WordPress plugin wpForo Forum has a vulnerability in input validation.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

YunzMall security vulnerabilities

YunzMall is an e-commerce solution from the Chinese company YunzMall. A security vulnerability exists in YunzMall 2.4.2 and earlier versions, which stems from a manipulation of the parameter pwd that can lead to weakened password recovery...

WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability

Full Path Disclosure FPD vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Plugin Vimeography versions = 2.4.4...

WordPress Plugin Code Embed Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...