CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-82227

Contributor SQL Injection in WPBulky = 1.2.2 versions...

CVE-2026-82220

Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...

CVE-2026-81767

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

CVE-2026-81284

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

EUVD-2026-43098

Phalcon: Catastrophic backtracking ReDoS in the default Phalcon Router route lead to remote unauthenticated DoS...

cve-2019-9053

versione aggiornata dello script...

WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin LeadConnector versions = 4.0.5...

EUVD-2026-67735

Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...

CVE-2026-81761 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in WpEvently = 5.5.0 versions...

EUVD-2026-67733

Subscriber Broken Access Control in WpEvently = 5.5.0 versions...

EUVD-2026-67734

Unauthenticated Broken Access Control in Simple Payment = 2.5.2 versions...

EUVD-2026-67730

Author Remote Code Execution RCE in Rank Math SEO = 1.0.276 versions...

EUVD-2026-67728

Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization = 4.2.0 versions...

EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin OwnerRez API versions = 1.2.6...

WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Booking and Rental Manager versions = 2.7.6...

WordPress Shared Files Pro plugin < 1.7.68 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files Pro versions 1.7.68...

WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by JunHee CHO in WordPress Plugin WPBulky versions = 1.2.2...

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Udin Chan in WordPress Plugin GiveWP versions = 4.16.7.1...