CVE-2026-16062: Deserialization of Untrusted Data

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields, allowing users with Contributor-level access and above to inject PHP objects. No POP chain is present in the Event Booking...

Exploit for CVE-2025-10897

CVE-2025-10897 !Pythonhttps://img.shields.io/badge/Python...

Exploit for CVE-2026-14483

CVE-2026-14483 — WPL Real Estate RCE Unauthenticated remote c...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

Exploit for CVE-2025-7384

CVE-2025-7384 — PHP Object Injection to RCE Plugin: Datab...

EUVD-2026-51757

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

CVE-2026-13157

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

EUVD-2026-51713

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-13157 Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-13157

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload executable...

CVE-2026-13157

The Theme Demo Import WordPress plugin (versions false override in $upload_overrides. This allows high-privilege users, such as default site administrators or non-super-admin site administrators in a Multisite architecture, to bypass restrictions and upload executable PHP scripts (e.g., .php, .p...

CVE-2026-13158

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import the WordPress file-type test is disabled, allowing high-privilege users Administrator by default, including non-super-admin site administrators on multisite to upload...

CVE-2026-13158

The Everest Toolkit WordPress plugin (versions 1.2.3 , implement strict whitelisting via wp_handle_upload(), and disable script execution in the uploads directory using .htaccess or Nginx rules. Proof-of-concept exploits for this vulnerability have been published in the wild.

CVE-2026-17543 affecting package php for versions less than 8.3.33-1

CVE-2026-17543 affecting package php for versions less than 8.3.33-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-7260 affecting package php for versions less than 8.3.33-1

CVE-2026-7260 affecting package php for versions less than 8.3.33-1. An upgraded version of the package is available that resolves this issue...

[SECURITY] Fedora 44 Update: php-8.5.9-1.fc44

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

RLSA-2026:48650 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-57456 vim: Vim:...

vim security update

An update is available for vim. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

PT-2026-67127

Name of the Vulnerable Software and Affected Versions Payment forms, Buy now buttons, and Invoicing System | GetPaid versions prior to 2.8.57 Description The plugin is susceptible to Local File Inclusion, a condition where an application includes files from the local file system without proper...