CVE-2026-66644

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-73397

Youzify plugin versions up to 1.3.7 suffer from unauthenticated deserialization of untrusted data, scored CVSS 9.8 (critical) with network access, no privileges, and full CIA impact. Upgrade beyond 1.3.7 or disable the plugin; no exploit code is provided in the documents.

CVE-2026-66644

WordPress Typing Effect plugin (versions

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-72570

CVE-2026-72570 affects the project cube-root/directory-serve up to version 1.3.7. The vulnerability is a stored XSS : uploading a file with a crafted filename containing HTML attribute-breaking characters allows the attacker to inject arbitrary JavaScript into the web interface. The root cause is...

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

EUVD-2026-55236

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-61985

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through = 1.3.7...

CVE-2026-57776

Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through = 1.3.7...

CVE-2026-61985

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through = 1.3.7...

CVE-2026-61985

CVE-2026-61985 affects the WordPress Car Rental Manager plugin (

CVE-2026-57776

CVE-2026-57776 affects the WordPress VW Wedding theme (vw-wedding) up to version 1.3.7. The issue is described as a Missing Authorization / Broken Access Control vulnerability resulting from incorrectly configured access control levels, allowing exploitation under the described scenario (per CVE ...

CVE-2026-57776 WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through = 1.3.7...

CVE-2026-61985 WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through = 1.3.7...

CVE-2026-40452 Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to...

WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Theme VW Wedding versions = 1.3.7...

CVE-2026-54906 affecting package rubygem-concurrent-ruby for versions less than 1.3.7-1

CVE-2026-54906 affecting package rubygem-concurrent-ruby for versions less than 1.3.7-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-54904

A flaw was found in concurrent-ruby. A remote attacker could exploit a vulnerability in the Concurrent::AtomicReferenceupdate method, which can enter a permanent busy retry loop. This occurs when the current value is a special 'Not a Number' Float::NAN floating-point value, causing the method to...

CVE-2026-54843

CVE-2026-54843 concerns the WordPress MDTF plugin (WordPress MDTF) with versions up to 1.3.7. The vulnerability is an unauthenticated SQL injection in MDTF

Linux Distros Unpatched Vulnerability : CVE-2026-54905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread...