Threat Intelligence Database

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component.

CVE-2026-78638 is a path traversal vulnerability in the peerigon unzip-crx package versions 0.1 and 0.2.0. The flaw exists in the unzip function of the dist/index.js file within the Archive Extraction component. An attacker with local access can manipulate the destination argument to perform path traversal. Exploit code has been published, but the vendor has not yet responded or issued a fix. The vulnerability has a medium severity rating with a CVSS score of 4.8.

The Mane WordPress theme by Elated-Themes contains a Local File Inclusion vulnerability in all versions up to and including 1.7. This vulnerability allows unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to full code execution and access control bypass.

The Jawn WordPress theme by MVPThemes contains a critical privilege escalation vulnerability (CWE-266) in all versions up to and including 1.4.2. This flaw allows unauthenticated attackers to elevate their privileges to administrator level. The vulnerability has a CVSS 3.1 score of 9.8, indicating a severe security risk. No official patch or remediation guidance has been provided yet.

WP Project Manager Pro plugin for WordPress versions up to and including 4.0.1 contains an SQL Injection vulnerability. This flaw allows authenticated users with Subscriber-level access or higher to inject additional SQL commands due to improper escaping and lack of query preparation. The vulnerability can lead to unauthorized extraction of sensitive database information. The CVSS score is 6.5, indicating a medium severity risk. No official patch or remediation guidance is currently provided by the vendor. No known exploits are reported in the wild.

Fluent Support Pro for WordPress up to version 2.3.1 has a missing authorization check vulnerability that allows authenticated users with Subscriber-level access or higher to perform unauthorized actions. This vulnerability is identified as CWE-862 and has a medium severity with a CVSS score of 4.3. No official patch or remediation guidance is currently provided by the vendor.

Fluent Boards Pro plugin for WordPress contains an authorization bypass vulnerability due to missing validation on a user-controlled key. This flaw affects all versions up to and including 2.0.11 and allows authenticated users with Subscriber-level access or higher to perform unauthorized actions. The vulnerability is classified as an Insecure Direct Object Reference (CWE-639).

The FURUNO ELECTRIC FA-50 CLASS B AIS Transponder contains hard-coded credentials and lacks authentication for additional configuration. This vulnerability could allow unauthorized users to access and modify device settings without proper verification. No specific affected versions or patches are currently identified. There is no evidence of known exploits in the wild at this time.

CVE-2026-78637 is a medium severity vulnerability in Fdawgs node-poppler versions 9.1.0 through 10.0.1. It involves argument injection via manipulation of the file_path argument in multiple PDF processing functions within src/index.js. The vulnerability can be exploited remotely. A patch identified by commit db6e3f79d3beb20601be7e59669c39811ae3c330 is recommended to fix the issue. No official remediation level or vendor advisory is provided in the data.