CVE-2026-24552

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3...

WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Relevanssi Light versions = 1.2.2...

CVE-2026-64873

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873

The Cache Cleaner Pro extension for Joomla (by regularlabs.com) is vulnerable to Server-Side Request Forgery (SSRF) . This vulnerability allows an attacker to use custom query URLs to access internal or reserved network services. Exploitation details are not provided in the documents. No remediat...

EUVD-2026-47897

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

CVE-2026-65755

The Joomla Extension by regularlabs.com , specifically the Articles Anywhere and Users Anywhere extensions, is affected by a date-sensitive query-cache leakage. The root cause is that query cache keys fail to retain a bounded time component , which can cause cached results to remain active beyond...

EUVD-2026-47894

Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially...

EUVD-2026-47925

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15761

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tceventfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Possible heap use-after-free in an error path when a DoT forwarded query is jostled out

...

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

Glances Cassandra Export Code Execution

The vulnerability of the Cassandra export module in the Glances monitoring tool’s application programming interface is related to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code...

PT-2026-63595

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc event filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

CVE-2026-65694: Improper Limitation of a Pathname to a Restricted Directory

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

CVE-2026-65491: Missing Authorization

Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...

CVE-2026-9066: Improper Neutralization of Input During Web Page Generation

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...