WordPress Block Slider plugin <= 2.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 in WordPress Plugin Block Slider versions = 2.2.3...

CVE-2026-21684 iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in CIccTagSpectralViewingConditions. This vulnerability affects users of th...

CVE-2026-22190

The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains an uncontrolled format string vulnerability. The -gp glyph pattern command-line option is used directly as the format string for sprintf with only a single argument supplied. If an attacker provides additional format...

@aigelb/chatbot-widget (>=5.0.0, <=8.2.0), @evelan/jexity-widget (>=0.0.1, <=0.13.1) +14 more potentially affected by CVE-2026-22028 via preact (>=10.27.0, <=10.27.2)

preact NPM version =10.27.0, =5.0.0, =0.0.1, =0.2.0-canary.7cb2837, =1.2.1, =1.4.1-snapshot-20251113025641, =3.0.263, =0.1.17, =0.1.17, =0.2.22, =1.14.0, =0.0.111, =0.0.122 - extension 3.11.1-canary.254.c83f9e7 and more Source cves: CVE-2026-22028 Source advisory: OSV:GHSA-36HM-QXXP-PG3M...

@knowbl_ai/nexus-chat (1.0.0), @wistia/wistia-player (0.4.0) +2 more potentially affected by CVE-2026-22028 via preact (>=10.28.0, <=10.28.1)

preact NPM version =10.28.0, =10.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on preact and may be impacted: - @knowblai/nexus-chat 1.0.0 - @wistia/wistia-player 0.4.0 - @wistia/wistia-player-react 0.4.0 - astro-og 0.3.1 Source cves: CVE-2026-2202...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2025-69264 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2025-69264 Source advisory: OSV:GHSA-379Q-355J-W6RJ...

WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin MediaPress versions = 1.6.2...

@agentbrowser/cli (>=1.0.0, <=1.0.1), @ai-tools/console-monkey-patch (0.0.1) +290 more potentially affected by CVE-2025-69262 via pnpm (>=6.35.1, <=10.18.3)

pnpm NPM version =6.35.1, =1.0.0, =0.0.1, =0.0.36-alpha.0a210b, =0.0.1, =0.1.0, =1.0.0, =5.0.0 - @dopt/esbuild-plugins 1.0.0 - @dopt/filter-open-source 1.0.0 and more Source cves: CVE-2025-69262 Source advisory: OSV:GHSA-2PHV-J68V-WWQX...

CVE-2026-21501 Stack Overflow in iccDEV Calculator Parser

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to stack overflow in the calculator parser. This issue has been patched in version 2.3.1.2...

CVE-2026-21497 NULL Pointer Dereference in iccDEV Unknown Tag Parser

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to version 2.3.1.2, iccDEV is vulnerable to NULL pointer dereference via an unknown tag parser. This issue has been patched in version 2.3.1.2...

WordPress FiboSearch plugin <= 1.32.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by PPzzAArr in WordPress Plugin FiboSearch versions = 1.32.1...

WordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra in WordPress Plugin X Addons for Elementor versions = 1.0.23...

WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Moody versions = 2.7.3...

CVE-2025-47552

CVE-2025-47552 concerns the WordPress plugin "DZS Video Gallery" (versions &lt;= 12.37). The issue is a deserialization of untrusted data leading to PHP Object Injection, which under the reported details could enable remote code execution. Public documentation body here confirms the vulnerability...

@ejazullah/playwright-mcp-server (>=1.0.0, <=1.88.0), @grebyn/toolentry-mcp-server (>=1.0.0, <=1.7.1) +24 more potentially affected by CVE-2025-9611 via @playwright/mcp (>=0.0.5, <=0.0.39)

@playwright/mcp NPM version =0.0.5, =1.0.0, =1.0.0, =1.0.8, =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.1.0, =1.3.1 and more Source cves: CVE-2025-9611 Source advisory: OSV:GHSA-6FG3-HVW7-2FWQ...

CVE-2025-69333

Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through = 3.8.1.1...

CVE-2025-14147

The Easy GitHub Gist Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the gist shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-14110

The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

actix-web-csp (0.1.0), actor-kit (>=0.1.0, <=0.2.1) +673 more potentially affected by unknown CVE via lru (>=0.9.0, <=0.15.0)

lru CARGO version =0.9.0, =0.1.0, =0.9.0, =0.0.24, =0.0.23, =0.1.0, =1.0.0, =0.4.0, =0.1.0, =0.1.0, =0.4.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0002...

WordPress Stumble! for WordPress plugin <= 1.1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] vulnerability

Reflected Cross-Site Scripting via $SERVER'PHPSELF' vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin Stumble! for WordPress versions = 1.1.1...