EUVD-2026-63303

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

CVE-2026-66586

WordPress WP Cafe Pro plugin (versions below 3.0.15) has a Local File Inclusion vulnerability, discovered by Ananda Dhakal of Patchstack. An authenticated author with high privileges can exploit it over the network to read sensitive server files, potentially compromising confidentiality, integrit...

CVE-2026-66583

CVE-2026-66583 is an unauthenticated PHP Object Injection vulnerability in the WordPress Forminator plugin , affecting versions

EUVD-2026-63332

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Theme FreightCo versions = 1.1.15...

CLSA-2026-1787223739 TuxCare security update for dompdf/dompdf (6 CVEs)

TuxCare rebuilt dompdf/dompdf to address 6 CVEs. Fixed in 1.2.2-p2+tuxcare...

CLSA-2026-1787221779 TuxCare security update for zendframework/zendframework1 (1 CVE)

TuxCare rebuilt zendframework/zendframework1 to address 1 CVE. Fixed in 1.10.6-p2+tuxcare...

OESA-2026-3475 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

WordPress All-in-One WP Migration and Backup plugin < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability

Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import vulnerability discovered by Mohamed Bassia in WordPress Plugin All-in-One WP Migration versions 7.108...

CVE-2026-14946

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

EUVD-2026-63217

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-14946 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-14946

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to remote code execution due to improper file type validation . A high-privileged remote attacker can upload a .php file and then request it directly from /uploads/.php, leading to arbitrary code execution and potential full system co...

WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability

Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...

WordPress Newsletters plugin < 4.16 - Unauthenticated PHP Object Injection via Date Form Field vulnerability

Unauthenticated PHP Object Injection via Date Form Field vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Newsletters versions 4.16...

WordPress Ajax Search Lite plugin < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability

Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability discovered by Jakub Herman in WordPress Plugin Ajax Search Lite versions 4.14.5...

WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flatastic versions = 2.0...

CVE-2026-75963

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-13405

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...