CVE-2026-15038

The CVE affects the InfiniteWP Client WordPress plugin (before 1.13.6). Root cause: it does not properly verify the site-connection state or the authenticity of requests to its remote-management endpoint on WordPress Multisite installations. Impact: unauthenticated attackers can bind their own ke...

CVE-2026-16955

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

CVE-2026-14526

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to creat...

EUVD-2026-54746

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to creat...

CVE-2026-14526

The AI Copilot – Content Generator plugin for WordPress is affected by an authorization bypass vulnerability in all versions up to and including 1.5.6. The issue arises because the plugin does not properly verify a user’s authorization to perform certain actions, enabling unauthenticated attacker...

CVE-2026-16955

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, enabling subscriber-level users to read arbitrary server files and exfiltrate them off-host. Reaching this at subscriber level requires a ...

EUVD-2026-54745

The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell Pre-Authentication Reflected X...

PT-2026-69186

Name of the Vulnerable Software and Affected Versions AI Copilot – Content Generator versions prior to 1.5.7 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can achieve full site...

CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-64637

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account...

EUVD-2026-54520

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability CWE-863 in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of...

EUVD-2026-54522

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege...

CVE-2026-14644

Nexus Repository 3 contains a privilege escalation vulnerability in the REST privileges API. An authenticated user who can manage privileges can elevate to full administrator under certain role configurations by abusing a type-confusion flaw in the privilege update endpoint. The CVE entry describ...

EUVD-2026-54516

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

CVE-2026-17599 Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

CVE-2026-17601 Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment...

CVE-2026-19264

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-56793

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...