EUVD-2026-96401

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

CVE-2026-108581

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-108585

argocd-mcp Argo CD MCP Server through 0.9.0 contains a path traversal vulnerability in the deleteapplication tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositorie...

TJ Sweet NornicDB Authorization Issue Vulnerability

TJ Sweet NornicDB versions 1.4.1 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification, which may allow authenticated users to bypass the database-read restriction on the /nornicdb/search and /nornicdb/similar endpoints, thereby...

CVE-2026-108547 AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...

CVE-2026-108164

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...

CVE-2026-108164 Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route

Open Source Social Network OSSN through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossncom.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/guid route with sequentia...

Resource Exhaustion

code.vikunja.io/api is vulnerable to a resource exhaustion. The vulnerability is due to the Planka migrator failing to enforce aggregate memory limits during migration jobs, which allows an authenticated attacker to exhaust worker memory by submitting migration requests to attacker-controlled...

Denial Of Service (DoS)

code.vikunja.io/api is vulnerable to a denial-of-service. The vulnerability is due to the failure to limit archive expansion during data import, which allows an authenticated attacker to upload highly compressed files that expand to tens of gigabytes in memory and on disk, exhaust server resource...

CVE-2026-96563

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-96574

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...

EUVD-2026-96206

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-103427 Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-103427 Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-96212

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttpfiltertaxonomy meta of the attacker-chosen post' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-96225

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpufpaymentmethod' parameter in all versions up to, and including, 4.3.12 due to...

AZL-110342 CVE-2026-17025 affecting package graphene 1.10.8-1

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-107120

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...

CVE-2026-104723

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-107120 Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...