🚨 CVE-2026-32554
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
🎖@cveNotify
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress WooBeWoo Product Filter Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32560
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
🎖@cveNotify
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.
🎖@cveNotify
Patchstack
Local File Inclusion in WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32563
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
🎖@cveNotify
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
🎖@cveNotify
🚨 CVE-2026-45404
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.
🎖@cveNotify
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.
🎖@cveNotify
GitHub
Release v1.45.0 (#8693) · open-telemetry/opentelemetry-go@93a693e
### Added
- Add experimental observability metrics to `BatchProcessor` in
`go.opentelemetry.io/otel/sdk/log`. (#7124)
- Add the experimental `WithUnsafeAttributes` no-copy attribute option
to `go....
- Add experimental observability metrics to `BatchProcessor` in
`go.opentelemetry.io/otel/sdk/log`. (#7124)
- Add the experimental `WithUnsafeAttributes` no-copy attribute option
to `go....
🚨 CVE-2026-68516
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.
🎖@cveNotify
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14.
🎖@cveNotify
GitHub
bump vendored openjph to 0.31.0 · AcademySoftwareFoundation/openexr@45521f9
Signed-off-by: Cary Phillips <seabeepea@gmail.com>
🚨 CVE-2026-77337
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
🎖@cveNotify
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
🎖@cveNotify
GitHub
security: replace unencrypted cookie auth tokens with verified, work-… · cakephp/authentication@c94d9a5
…factor-bounded HMAC-SHA256 tokens
🚨 CVE-2026-77384
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.
🎖@cveNotify
libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9.
🎖@cveNotify
GitHub
fix(circuit-relay-v2): avoid leaking abort listeners on refresh (#3560) · libp2p/js-libp2p@4bb8fbe
* test(circuit-relay-v2): add failing test for reservation refresh listener leak
Asserts that refreshing a reservation does not attach additional abort listeners to the reused signal.
* fix(circu...
Asserts that refreshing a reservation does not attach additional abort listeners to the reused signal.
* fix(circu...
🚨 CVE-2026-78262
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
🎖@cveNotify
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
🎖@cveNotify
Patchstack
PHP Object Injection in WordPress WP Project Manager Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78263
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Event Tickets Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78264
Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Toolset Blocks Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78265
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
🎖@cveNotify
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
🎖@cveNotify
Patchstack
PHP Object Injection in WordPress The Events Calendar Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78267
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
🎖@cveNotify
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress TranslatePress Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78268
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads…
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78282
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Stripe Payments Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78284
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
🎖@cveNotify
Patchstack
Arbitrary File Deletion in WordPress MasterStudy LMS Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.