Threats affecting pkg:generic/radare2

CVE-2026-52713 is a missing authorization vulnerability in ThimPress LearnPress affecting versions prior to 4.4.13. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized information disclosure or modification. The issue has been addressed in version 4.4.13.

CVE-2026-119467 is a missing authorization vulnerability in WPVibes AnyWhere Elementor plugin versions prior to 1.3.1. This flaw allows attackers with limited privileges to exploit improperly configured access controls, potentially leading to integrity and availability impacts. The issue is fixed in version 1.3.1.

CVE-2026-66669 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Suplugins Superb Addons: Blocks, Patterns & Theme Designer versions prior to 4.2.5. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 4.2.5.

CVE-2026-119510 is a stored cross-site scripting (XSS) vulnerability in Saeed MC Woocommerce Wishlist versions prior to 2.0.4. The flaw arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This vulnerability affects versions from initial releases up to 2.0.3 and has a CVSS score of 6.5, indicating a medium severity level.

CVE-2026-123958 is a critical buffer overflow vulnerability in TOTOLINK CA300-PoE version 6.2c.884. The flaw exists in the setLanConfig function of the /cgi-bin/cstecgi.cgi file, where manipulation of the lanDns, lanSecDns, or langType arguments can trigger the overflow. This vulnerability can be exploited remotely without user interaction. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-121781 is a missing authorization vulnerability in WP ManageNinja LLC's Fluent Booking plugin. It affects versions from initial releases up to 2.5.0. The flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 2.6.0.

CVE-2026-119489 is a stored cross-site scripting (XSS) vulnerability in the WP Recipe Maker plugin by Bootstrapped Ventures. It affects all versions from initial releases up to 10.9.1. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to inject malicious scripts. A fix is available in version 10.9.2.

CVE-2026-120849 is a missing authorization vulnerability in WC Lovers WCFM Marketplace versions prior to 3.8.4. It allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue is fixed in version 3.8.4.

CVE-2026-120848 is a stored cross-site scripting (XSS) vulnerability in WC Lovers WCFM Marketplace versions prior to 3.8.4. The flaw involves improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This vulnerability has a medium severity rating with a CVSS score of 6.5 and affects versions from initial releases up to 3.8.3. A fix is available in version 3.8.4.

CVE-2026-124274 is a missing authorization vulnerability in the myCred plugin affecting versions prior to 4.0.3. It allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to integrity impact without confidentiality or availability loss. The issue is fixed in version 4.0.3.

CVE-2026-122675 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wpmet Wp Social plugin affecting versions prior to 3.2.4. This flaw allows an attacker to trick authenticated users into performing unwanted actions on the site. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 3.2.4.

CVE-2026-121761 is a missing authorization vulnerability in Infomaniak Network's VOD Infomaniak product. It allows exploitation due to incorrectly configured access control security levels. The issue affects versions from initial releases up to 1.5.15 and is fixed in version 1.5.16. The vulnerability has a medium severity rating with a CVSS score of 4.3.

CVE-2026-121767 is a missing authorization vulnerability in the weDevs weDocs plugin affecting versions prior to 2.6.2. It allows unauthorized access due to incorrectly configured access control security levels. The issue is fixed in version 2.6.2.

CVE-2026-121778 is a missing authorization vulnerability in WP Lab's WP-Lister Lite for Amazon plugin, affecting versions prior to 2.9.2.5. The flaw allows exploitation of incorrectly configured access control, potentially enabling unauthorized access to certain plugin functionalities. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 2.9.2.5.

CVE-2026-121779 is a vulnerability in YITH WooCommerce Subscription versions prior to 4.23.0 that allows unauthorized parties to retrieve embedded sensitive system information. This exposure could potentially aid attackers in further reconnaissance but does not directly impact system integrity or availability.

CVE-2026-39733 is a Cross-Site Scripting (XSS) vulnerability in the ProfilePress plugin for WordPress, specifically in the wp-user-avatar component. It allows improper neutralization of script-related HTML tags, leading to potential code injection. This affects ProfilePress versions from initial releases up to 4.17.7. The vulnerability has a medium severity score of 5.3 and is fixed in version 4.18.0.

The genblaze-atlascloud package on PyPI version 0.1.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.

The genblaze-fal package on PyPI version 0.1.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.

The Advanced Form Integration — Connect Forms to 300+ Apps WordPress plugin up to version 2.10.2 is vulnerable to PHP Object Injection via deserialization of untrusted input. Exploitation requires an administrator to have configured at least one active NexForms integration. No direct impact occurs unless another plugin or theme with a PHP Object Injection POP chain is present, which could then enable actions like arbitrary file deletion, data retrieval, or code execution. The vulnerability affects versions up to and including 2.10.2 and has a high severity CVSS score of 8.1.

The dsh-notify-focus npm package contains malicious code that fully compromises any computer on which it is installed or running. Removal of the package does not guarantee elimination of all malicious software installed as a result. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised.