CVE-2026-11397 WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter

The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 3.9.30 via the wpieimportuploadfilefromurl AJAX action. The plugin's URL downloader first calls wpsaferemoteget which correctly blocks private/reserved IP ranges, but wh...

SUSE CVE-2026-44495

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse,...

CVE-2026-12731 weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and outpu...

CVE-2026-14327

The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 8.40 via the 'file' parameter. Unauthenticated attackers can read arbitrary server files. Exploitation requires obtaining a valid nonce via ar_get_fresh_nonce and ar_process_user_ima...

PT-2026-55544

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 Dell PowerProtect Data Domain LTS2026 release versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data...

PT-2026-55539

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 Dell PowerProtect Data Domain LTS2026 release versions 8.6.1.0 through 8.6.1.10 Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.30 Dell PowerProtect Data...

CVE-2026-8247

WatchGuard Fireware OS contains an out-of-bounds write vulnerability (CVE-2026-8247) affecting Fireware OS 11.0–11.12.4_Update1, 12.0–12.12, and 2025.1–2026.2. An unauthenticated attacker on the same local network segment can potentially execute arbitrary code. The advisory lists the vulnerable c...

CVE-2026-13728

WatchGuard Fireware OS on a FireCluster is affected by CVE-2026-13728. Affected versions include Fireware OS 12.1 through 12.12, and 2025.1 through 2026.2. In exception circumstances, an embedded encryption key is used to encrypt saved credentials for Access Portal resources, which constitutes th...

CVE-2026-13384

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI...

NPM: jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

NPM: jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion vulnerability discovered by ? in WordPress Npm jsonata versions 2.2.0...

GHSA-GVJC-3W7C-92JX Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block

Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections and is syncing or catching up to the chain tip. Summary A malicious peer can answer Zebra's outbound getblocks/FindBlocks request with a small two-hash inventory, then ser...

Security Bulletin: Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass

Summary A path traversal vulnerability existed in the File component's tar archive extraction functionality. An authenticated user could upload a specially crafted tar archive containing symbolic links to read arbitrary files accessible to the application process. The vulnerability allowed an...

@grackle-ai/cli (>=0.72.3, <=0.132.1), @grackle-ai/core (>=0.75.4, <=0.132.1) +7 more potentially affected by unknown CVE via @grackle-ai/auth (>=0.72.3, <=0.132.1)

@grackle-ai/auth NPM version =0.72.3, =0.72.3, =0.75.4, =0.72.3, =0.96.3, =0.99.0, =0.97.0, =0.98.0, =0.72.3, =0.75.1, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-F9FF-5X35-7GFW...

@grackle-ai/cli (>=0.72.3, <=0.132.1), @grackle-ai/core (>=0.75.4, <=0.132.1) +7 more potentially affected by unknown CVE via @grackle-ai/auth (>=0.72.3, <=0.132.1)

@grackle-ai/auth NPM version =0.72.3, =0.72.3, =0.75.4, =0.72.3, =0.96.3, =0.99.0, =0.97.0, =0.98.0, =0.72.3, =0.75.1, =0.132.1 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIAUTH-17817919...

@grackle-ai/cli (>=0.107.2, <=0.132.1), @grackle-ai/plugin-orchestration (>=0.97.0, <=0.132.1) +1 more potentially affected by unknown CVE via @grackle-ai/plugin-core (>=0.97.0, <=0.132.1)

@grackle-ai/plugin-core NPM version =0.97.0, =0.107.2, =0.97.0, =0.107.2, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-F9FF-5X35-7GFW...

Security Bulletin: Remote Code Execution in CUGA Component CodeAgent

Summary An authenticated user could execute arbitrary commands on the server when the CUGA component is installed and a flow using CUGA's CodeAgent is created and executed. The vulnerability exists in the CodeAgent's Python code execution path, which permits object graph introspection to recover...

GHSA-4Q9J-6299-GXMR Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

Summary The Dragonfly Manager exposes GET /api/v1/oauth and GET /api/v1/oauth/:id to unauthenticated clients. The response body deserializes the entire manager/models.Oauth struct, which includes the clientsecret field. Any network-reachable attacker can read the OAuth client secrets configured f...

@grackle-ai/cli (>=0.82.2, <=0.132.2), @grackle-ai/powerline (>=0.82.2, <=0.132.2) +6 more potentially affected by unknown CVE via @grackle-ai/runtime-sdk (>=0.82.2, <=0.132.2)

@grackle-ai/runtime-sdk NPM version =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.132.2 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIRUNTIMESDK-17817938...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53807 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53807 Source advisory: OSV:GHSA-W5WW-7CHG-MXCQ...

NPM: OpenClaw: Matrix allowFrom could bind to mutable display names

NPM: OpenClaw: Matrix allowFrom could bind to mutable display names vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.6...