Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

Published 2026-10-07 by Wordfence

Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter

Published 2026-10-07 by Wordfence

pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)

Published 2026-10-07 by PostgreSQL

pgjdbc does not enforce requireAuth when the value excludes every authentication method

Published 2026-10-07 by PostgreSQL

Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions

Published 2026-10-07 by HashiCorp

Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Published 2026-10-07 by HashiCorp

Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots

Published 2026-10-07 by HashiCorp

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Published 2026-10-07 by GitHub_M

AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

Published 2026-10-07 by GitHub_M

AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

Published 2026-10-07 by GitHub_M