CVE-2026-19603

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the...

CVE-2026-109982

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently delete...

CVE-2026-110014

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users'...

CVE-2026-109193

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-51996

⚠️ CVE-2024-51996 - Symfony RememberMe Auth Bypass Exploit Exploit for the critical vulnerability CVE-2024-51996 , which allows authentication bypass in Symfony applications that use the Remember Me mechanism. 🧠 Impact : Impersonation of privileged users such as admin without the need for valid...

CVE-2026-19603 Private channel ID disclosure via user status endpoints

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the...

CVE-2026-19603

Mattermost versions 11.9.x <= 11.9.1 , 11.8.x <= 11.8.5 , 11.7.x <= 11.7.10 , and 11.10.x

EUVD-2026-102742

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the...

ExtensionHijack

ExtensionHijacker A possible malware persistence method. Hijacking extensions registered for the current user. Read more here proxyapp - a proxy application, used to handle hijacked extensions hijackerapp - installs the proxy application and redirects extension handling to the proxy...

WSO2-2020-0731

WSO2-2020-0731: XXE and XSS vulnerabilities in WSO2 Carbon A potential XXE and XSS have been identified in multiple WSO2 Products. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Why no CVE? Neither me nor the vendor requested a CVE for these...

MAL-015

MAL-015: Isolation Escape 2 in Ansible Tower Installations of Ansible Tower on certain Rhel 7/8 setups are potentially vulnerable to “Job Isolation” Escapes that allows an attacker to elevate to the “awx” user from outside the isolated environment. The following files/setups can be leveraged by...

CVE-2026-15222

The User Registration & Membership plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 5.2.8 . The root cause is a failure to properly validate values before processing the do_shortcode function. This allows authenticated attackers with subscrib...

EUVD-2026-102801

The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software...

CVE-2026-15222 User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name

The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software...

EUVD-2026-102797

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-109193 HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-109193

The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.7.32 . The root cause is insufficient input sanitization and output escaping of the parameter (e.g., hp_custom_link). An unauthe...

CVE-2026-109447

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the role parameter handled by the wppbaddmetatouseronactivation function. The vulnerability...

CVE-2026-107748

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping...

CVE-2026-100186

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes ...