CVE-2026-59808

AVideo (through commit 9c39d8c8) is affected by an authentication bypass vulnerability. The root cause lies in deduplicateByEncoderQueueId(), which returns video_id_hash credentials for any video by encoder_queue_id without ownership verification , and useVideoHashOrLogin(), which converts this h...

CVE-2026-78003

The Mailgun for WordPress plugin for WordPress (versions up to and including 2.2.0 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) via path traversal. The root cause is insufficient input validation in the add_list() function, which accepts user-controlled array keys from...

CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-77001 Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin, in versions prior to 1.8.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The flaw exists because the plugin fails to properly sanitise and escape a custom post type setting before rendering it within an HTML attribute on...

CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-76789: Improper Neutralization of Input During Web Page Generation

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...

PT-2026-79541

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit 9c39d8c8 Description An authentication bypass exists where the deduplicateByEncoderQueueId function returns video id hash credentials for any video based on the encoder queue id without verifying ownership...

CVE-2026-16260: Improper Neutralization of Input During Web Page Generation

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-60084: Improper Limitation of a Pathname to a Restricted Directory

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

CVE-2026-69237

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-49849

xShop is an open-source e-commerce platform built with Laravel . Version 3.0.3 contains an Unrestricted File Upload vulnerability in the File Attachment Module within the Admin panel. An authenticated administrator can upload executable files (e.g., .php), enabling Remote Code Execution (RCE) and...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-49849 xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution

xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files e.g., .php. By uploading a specially crafted php file, an attacker can achieve Remote Code Execution RCE on the...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addJs and addCss methods in the Twig sandbox allowlist. An attacker can execute arbitrary scripts in the...

CVE-2026-70656

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression...