CVE-2026-59551 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-59532

The CVE concerns the WordPress Booking and Rental Manager plugin for WooCommerce (versions

CVE-2026-61511 vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by luc in WordPress Plugin FormCraft versions = 3.9.15...

WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Addons for Contact Form 7 versions =3.5.45...

@0xd541ecb3/byte-babe (>=1.0.0, <=1.2.1), @514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64) +765 more potentially affected by CVE-2026-55968 via thrift (>=0.6.0-1, <=0.23.0)

thrift NPM version =0.6.0-1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.6, =0.0.0-dev, =1.0.0, =0.9.0, =0.3.0, =0.0.1, =0.2.0, =0.2.0, =0.1.0, =1.0.0-beta.1, =1.0.0-beta.6 and more Source cves: CVE-2026-55968 Source advisory: SNYK:JS-THRIFT-18388780...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

!IMPORTANT This repository is intended for learning about...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Location Weather versions = 3.0.6...

CVE-2026-14235 WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...

EUVD-2026-49072

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

PT-2026-64924

Unauthenticated Sensitive Data Exposure in Ebook Store = 6.19 versions...

PT-2026-65192

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 watchOS versions prior to 26.6 Description An information disclosure issue exists where an app may be able to access...

PT-2026-64939

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

PT-2026-65167

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description A permissions issue exists where an application may be able to read files outside of its sandbox. Sandboxing is a...

Atlassian Confluence 7.17.x / 7.19.x / 8.5.x / 8.9.x / 9.0.1 / 9.1.x / 9.2.x < 9.2.22 / 10.0.2 / 10.1.x / 10.2.x < 10.2.14 (CONFSERVER-104340)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104340 advisory. - This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2,...