EUVD-2026-60601

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with accessadminsuper=true to escalate to super-admin, gaining scheduler and Twig evaluation capabilities...

CVE-2026-15602

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

EUVD-2026-59851

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2026-73143

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...

CVE-2026-73046

Technical details for CVE-2026-73046 are not publicly provided in the supplied documents; monitor for updates from vendors and advisories.

CVE-2026-73046

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...

CVE-2026-18216

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without...

CVE-2026-68752

A Project Resource Manager may gain broader administrative privileges under specific conditions...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

EUVD-2026-57231

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

Exploit for CVE-2026-72898

🔴 CVE-2026-72898 - Unauthenticated SQL Injection Met...

GHSA-VWF4-M7J8-WCJF

creationtimestamp| type| source ---|---|--- 2026-08-12 08:00:05+00:00| seen| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-13 00:00:43+00:00| published-proof-of-concept| Telegram/ZtTgk35S8DFYm2bUVjFVqqtPnGYEzTcbCUrks9IGhgQhA 2026-08-16 20:29:14+00:00| seen|...

CVE-2026-72559

HortusFox 5.9 contains a stored cross-site scripting vulnerability that lets authenticated workspace members inject persistent JavaScript into plant notes. Parsedown rendering without safe mode renders notes unescaped for every user viewing the affected plant, enabling potential session cookie th...

CVE-2026-72898

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2026-72898 Metabase SQL injection via password reset endpoint

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

Metabase-Exploit

Metabase SQL Injection Zero-Day Exploit GHSA-vwf4-m7j8-wcjf...

CVE-2026-13701

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

CVE-2026-14238 Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

CVE-2026-14238

The CVE-2026-14238 affects the Vitepos WordPress plugin prior to version 3.6.0. Affected component is a report endpoint that uses an identifier from a REST request body directly in a database query without proper sanitization/parameterization, enabling SQL injection for users with administrator-l...

EUVD-2026-55022

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...