CVE-2026-6453 CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

CVE-2026-6453

The CVE-2026-6453 issue affects the CubeWP Framework WordPress plugin (all versions ≤ 1.1.30). The root cause is insufficient input sanitization in cubewp_remove_relation() where wp_unslash() is applied to the relation_id parameter and then interpolated directly into a raw SQL query without using...

EUVD-2026-51792

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

CVE-2026-6453 CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

EUVD-2026-51742

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-16087 Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-16087 Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-16087

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

BELL-CVE-2026-58039

Bulletin has no description...

GHSA-34RH-WP3J-6CXC

creationtimestamp| type| source ---|---|--- 2026-08-01 04:31:50+00:00| seen| https://gist.github.com/alon710/402cd5e451c20f1dfc47c5b8f0cf1ddb...

CVE-2026-13362

creationtimestamp| type| source ---|---|--- 2026-08-01 03:54:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gcdixbwv2q47d...

MINI-R6C6-2Q4P-2728

Bulletin has no description...

PT-2026-67342

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple id token and decoding only its base64 payload without verifying the JWT signature against Apple...

CVE-2026-16087: Improper Neutralization of Special Elements used in an SQL Command

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-18344: Improper Neutralization of Input During Web Page Generation

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsivethumbnailimagemanagement function, which...

PT-2026-67261

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewp remove relation AJAX function, specifically the use of wp unslash on the relation id parameter before interpolating it...

CVE-2026-67330: Improper Input Validation

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

PT-2026-67130

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive thumbnail image management function, which...

kernel: ipc: limit next_id allocation to the valid ID range

A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...

CVE-2026-8347

creationtimestamp| type| source ---|---|--- 2026-07-31 22:00:02+00:00| seen| Telegram/CaZ2R0Efl1eBRVqO-sOZ66dFvtq0HENlFRwe45W-Oe0iQ 2026-08-01 00:00:10+00:00| seen| Telegram/CaZ2R0Efl1eBRVqO-sOZ66dFvtq0HENlFRwe45W-Oe0iQ 2026-09-06 14:00:06+00:00| seen| https://t.me/hackingAttack/192729 2026-09-07...