CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CLEANSTART-2026-SK95653 Security fixes in kapp-controller 0.57.0-r0

Package kapp-controller version 0.57.0-r0 fixes 6 vulnerabilities: ghsa-hfvc-g4fc-pqhx, ghsa-p77j-4mvh-x3m3, ghsa-mh2q-q3fh-2475, CVE-2026-33186, CVE-2026-39883...

Fedora 44 : valkey (2026-3d18a65cc4)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3d18a65cc4 advisory. Valkey 9.0.5 - Released Tue 21 July 2026 Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible...

CVE-2026-54540

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...

CVE-2026-55579

CVE-2026-55579 affects the PHP single-file editor Pheditor. From 2.0.1 up to before 2.0.6, it ships with a hardcoded default password (admin) whose SHA-512 hash is in pheditor.php:11, with no mechanism to force a first-login password change. An attacker using the default credentials gains full ac...

CVE-2026-65505

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65503 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65503 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

EUVD-2026-47918

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-60557

CVE-2026-60557 affects Oracle WebCenter Sites (Oracle Fusion Middleware) in versions 12.2.1.4.0 and 14.1.2.0.0. The issue allows an unauthenticated attacker with network access over HTTP to compromise WebCenter Sites, with human interaction required for exploitation. Impact per sources: potential...

CVE-2026-47057

The CVE-2026-47057 entry concerns Oracle Java SE (Scripting) with affected versions listed as 8u491, 8u491-perf, and 11.0.31. The vulnerability is exploitable over the network via multiple protocols and can allow an unauthenticated attacker to cause a hang or crash (complete DOS). The flaw can be...

PYSEC-2026-1797 Cross-Frame Scripting vulnerability has been found on Plone CMS

A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element...

Malicious code in bytekit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbaea22b635a4a8425964572b733b806f45714a9090492d1c39d545088fe336 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

WordPress Editorial Rating – Product Review & Rating System plugin <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Supoj Polsawas sp0x5ec in WordPress Plugin Editorial Rating – Product Review & Rating System versions = 4.0.5...

CVE-2026-47240

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing...

CVE-2026-50656

creationtimestamp| type| source ---|---|--- 2026-06-17 02:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moh7qulrzn2n 2026-06-17 08:36:55+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-av26-607 2026-06-17 10:00:59+00:00| seen|...

PT-2026-48266

Evoluted PHP Directory Listing Script through 4.0.5 contains a reflected cross-site scripting vulnerability in index.php where the dir parameter value is reflected without HTML encoding inside the HTML title element and inside anchor href attributes in the breadcrumb navigation. Attackers can...

CVE-2026-8423

The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site's active...

CVE-2026-33807

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time,...

DEBIAN-CVE-2026-40898

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field...