CVE Database

CVE-2026-54711 Low · 2.4 CWE-532 Oct 23, 2026

PGHoard: Password written to debug log

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

CVE-2026-115752 Medium · 4.2 CWE-918 Oct 23, 2026

Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.

CVE-2026-115751 Low · 3.7 CWE-184 Oct 23, 2026

mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.

CVE-2026-115750 Low · 3.7 CWE-522 Oct 23, 2026

mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.

CVE-2026-115749 Low · 3.3 CWE-470 Oct 23, 2026

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.

CVE-2026-115730 Low · 3.1 CWE-74 Oct 23, 2026

i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

CVE-2026-115729 Medium · 6.8 CWE-918 Oct 23, 2026

@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.

CVE-2026-115728 High · 7.5 CWE-1333 Oct 23, 2026

@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

CVE-2026-112855 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.

CVE-2026-112863 High · 7.1 CWE-79 Oct 23, 2026

WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.

CVE-2026-112859 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

CVE-2026-112858 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

CVE-2026-112857 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

CVE-2026-112856 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

CVE-2026-112854 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

CVE-2026-112853 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

CVE-2026-112852 High · 8.1 CWE-502 Oct 23, 2026

WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

CVE-2026-112851 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

CVE-2026-112850 High · 8.1 CWE-98 Oct 23, 2026

WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.

CVE-2026-112849 High · 7.1 CWE-79 Oct 23, 2026

WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.

CVE-2026-112848 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

CVE-2026-112847 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.

CVE-2026-112846 Critical · 9.8 CWE-502 Oct 23, 2026

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.

CVE-2026-98911 High · 7.5 Oct 23, 2026

dpaa2-switch: fix the error path in dpaa2_switch_rx()

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since the dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors, meaning that it expects in the software annotation area of the FD data to find a valid skb pointer on which to call dev_kfree_skb(). Fix this by extracting the dma_unmap_page() from dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx() function. This allows us to directly use free_pages() in case of an error before an SKB was created and kfree_skb() afterwards.

CVE-2026-98916 Unknown Oct 23, 2026

wifi: nl80211: check link is beaconing for color change

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.