CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

EUVD-2026-59852

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498 Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

CVE-2026-14498

Affected software: Query Wrangler plugin for WordPress (tested up to version 1.5.57). Vulnerability: Remote Code Execution via the options parameter in the wp_ajax_qw_form_ajax handler. Root cause is a missing capability check and nonce verification, with unsanitized attacker-controlled options b...

Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c8w8-3pqp-wr83. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by...

PT-2026-73085

Name of the Vulnerable Software and Affected Versions Query Wrangler versions prior to 1.5.58 Description Authenticated attackers with subscriber-level access and above can achieve Remote Code Execution on the server. The issue exists in the wp ajax qw form ajax handler due to a lack of capabilit...

CVE-2026-14498: Unrestricted Upload of File with Dangerous Type

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...

PT-2026-73112

Name of the Vulnerable Software and Affected Versions Slider Hero versions prior to 9.1.8 Description An issue exists where authenticated attackers with administrator-level access can perform a second-order SQL Injection. While slide data such as description, title, btn, btn2, image link, and...

PT-2026-122434

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c8w8-3pqp-wr83. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by...

PT-2026-73137

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the ' gallery order post id' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVE-2026-73054

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...

CVE-2026-73054 SiYuan before v3.7.4 Authentication Bypass via WebSocket

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...

CVE-2026-73054 SiYuan before v3.7.4 Authentication Bypass via WebSocket

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...

CVE-2026-73054

CVE-2026-73054 affects SiYuan versions before v3.7.4. The vulnerability is an authentication bypass in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocke...

CVE-2026-73054

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...

CVE-2026-73054

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...

CVE-2026-74324

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

CVE-2026-74324

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

UBUNTU-CVE-2026-74324

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...