Threats affecting pkg:generic/osquery

CVE-2026-61992 is a critical unauthenticated PHP Object Injection vulnerability affecting GEO my WordPress versions up to 4.5.5.3. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A Cross Site Scripting (XSS) vulnerability exists in Podamibe Custom User Gravatar versions up to and including 1.0.8. This vulnerability affects subscribers and allows for execution of malicious scripts in the context of the affected application.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Razorpay Payment Button Elementor Plugin versions up to and including 1.2.8. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Easy Property Listings versions up to and including 3.5.25. This vulnerability allows an attacker to execute malicious scripts in the context of the affected application without requiring authentication.

CVE-2026-61991 is a critical unauthenticated remote code execution vulnerability affecting AjaxLoadMore Cache versions up to and including 3.1.1. This flaw allows an attacker to execute arbitrary code remotely without any authentication, posing a severe risk to confidentiality, integrity, and availability.

CVE-2026-54858 is a critical unauthenticated PHP Object Injection vulnerability affecting Printy versions up to and including 1.13.0. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise with high confidentiality, integrity, and availability impact.

CVE-2026-54856 is a critical unauthenticated PHP Object Injection vulnerability affecting RexCoin versions up to 1.2.6. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A PHP Object Injection vulnerability exists in YayMail versions up to and including 4.4.6. This flaw allows a shop manager with high privileges to potentially execute malicious object injection attacks. The vulnerability is identified as CVE-2026-42701 and has a high severity rating with a CVSS score of 7.2.

CVE-2026-54860 is a critical unauthenticated PHP Object Injection vulnerability affecting Ozisti versions up to and including 1.1.10. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

A Cross-Site Scripting (XSS) vulnerability exists in Themeum Kirki kirki up to version 6.4.0 due to improper neutralization of script-related HTML tags. This vulnerability allows an attacker with low privileges to inject code that can be executed in the context of other users' browsers. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.

A vulnerability in Barn2 Plugins Document Library Lite (up to version 1.3.0) allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. The issue is identified as CVE-2026-48200 and has a medium severity rating with a CVSS score of 5.3.

CVE-2026-54859 is a critical unauthenticated PHP Object Injection vulnerability affecting Preservation software versions up to and including 1.15. This flaw allows an attacker to inject malicious PHP objects without authentication, potentially leading to full system compromise.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Post Video Players versions up to and including 1.165. This vulnerability allows attackers to inject malicious scripts without authentication.

CVE-2026-54857 is a critical unauthenticated PHP Object Injection vulnerability affecting Quirky versions up to and including 1.23. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.

Frappe versions before 15.121.0 and 16.x before 16.34.0 have a path traversal vulnerability in their file upload handling. This flaw allows authenticated attackers to upload files outside the intended storage directory, potentially leading to remote code execution on the server. The vulnerability is critical with a CVSS score of 9.9.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote attacker to execute stored Python component code within a public workflow. This execution occurs under the flow owner's runtime context on the server, bypassing intended trust boundaries that restrict public execution to server-trusted code. The vulnerability is identified as CVE-2026-18894 and has a medium severity rating with a CVSS score of 6.5.

A broken access control vulnerability exists in LearnPress versions up to and including 4.4.10, allowing subscribers to potentially access unauthorized functionality or data.

CVE-2026-27394 is an unauthenticated cross-site scripting (XSS) vulnerability affecting Eventer versions up to and including 0.1.1. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.

CVE-2026-20942 is a medium severity vulnerability in Microsoft Edge (Chromium-based) involving improper restriction of rendered UI layers or frames. This flaw allows an unauthorized attacker to perform spoofing attacks over a network by manipulating the user interface presentation. The vulnerability does not impact confidentiality, integrity, or availability beyond the potential for user interface spoofing.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in WP Crowdfunding versions up to and including 2.2.2. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.