EUVD-2026-53109

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data...

openjdk: Enhance Jar file processing (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...

CVE-2026-15314

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash...

CVE-2026-15314 Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash...

CVE-2026-15314

CVE-2026-15314 affects Tapo P110 v1 smart Wi‑Fi Plug. The vulnerability is an improper boundary validation in handling authenticated HTTP request bodies, due to insufficient input validation before memory copy operations. This can cause a buffer overflow, leading the web service process to crash ...

CLSA-2026-1785380881 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.16.0-tuxcare.2...

CLSA-2026-1785204378 TuxCare security update for ws (8 CVEs)

TuxCare rebuilt ws to address 8 CVEs. Fixed in 6.2.1-tuxcare.1...

CLSA-2026-1785204342 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 8.16.0-tuxcare.1...

CLSA-2026-1784769619 TuxCare security update for ws (5 CVEs)

TuxCare rebuilt ws to address 5 CVEs. Fixed in 4.1.0-tuxcare.2...

Important: java-1.8.0-amazon-corretto

Issue Overview: Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit...

CVE-2026-18738

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...

CVE-2026-16563

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16565 Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

CVE-2026-15939

The CVE describes an issue in the Simple Restrict WordPress plugin prior to 1.2.9 where REST API access is not protected by the plugin’s own permission system, instead relying on a generic capability check. This allows users with contributor-level access or higher to read content from restricted ...

CVE-2026-53510

Savon (Ruby SOAP client) contains a vulnerability in Savon::Model.all_operations, which interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing arbitrary code execution in the application process. Affected versions are 0.9.8 through 2.17.1; the issue...

CVE-2026-53510

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

CVE-2026-14319 GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details...

CVE-2026-14319

The CVE-2026-14319 entry concerns the GiveWP WordPress plugin prior to version 4.16.3. A REST API endpoint does not properly restrict access, allowing unauthenticated users to retrieve recurring-donation records, including names and subscription details of anonymous donors. Root cause is insuffic...

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...