CVE-2026-15780

CVE-2026-15780 is an unauthenticated Stored Cross-Site Scripting vulnerability in the WP Statistics WordPress plugin (all versions ≤ 14.16.8). The root cause is insufficient input sanitization and output escaping of the utm_campaign parameter. Attackers can plant a malicious payload without authe...

CVE-2026-18466

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-18466 WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-18231

The WP Directory Kit WordPress plugin (versions before 1.5.7 ) contains a vulnerability where a public AJAX action, specifically select_2_ajax_user, fails to perform adequate authorization checks . This flaw allows unauthenticated attackers to retrieve unfiltered database rows, resulting in the e...

kviklet v0.8.0

Kviklet Kviklet.dev | Release Notes | Discord Secure access to production environments without impairing developer productivity. Kviklet pronounced Quick-let embraces the Four-Eyes Principle and a high level of configurability to allow a Pull Request-like Review and Approval flow for individual S...

CVE-2026-52875

creationtimestamp| type| source ---|---|--- 2026-08-19 00:13:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/imviueam5oza2...

Oracle Linux 10 : mysql8.4 (ELSA-2026-56007)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-56007 advisory. 8.4.11-1 - Rebase to 8.4.11 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

PT-2026-78792

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Automation Engineer role can execute arbitrary Structured Query Language SQL statements against the database. This occurs during custom list retrieval within a playbook, enabling...

PT-2026-78532

Name of the Vulnerable Software and Affected Versions The product name cannot be determined versions prior to 14.0101 Description An application component insecurely processes user-supplied parameters by passing them into SQL queries. This flaw allows for blind SQL injection, a technique used to...

CVE-2026-18466: Improper Access Control

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2025-14603: Undefined Security Weakness

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2026-75920: Insecure Temporary File

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2026-75919: Missing Authentication for Critical Function

phpMyFAQ before 4.1.7 contains an authentication bypass vulnerability in SetupController that allows unauthenticated attackers to run database migrations and create configuration backups when maintenance mode is enabled. Attackers can call POST /api/setup/update-database and POST /api/setup/backu...

PT-2026-78345

Name of the Vulnerable Software and Affected Versions Nikstore Core versions prior to 1.6 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database,...

PT-2026-78294

Name of the Vulnerable Software and Affected Versions WP Maps versions prior to 4.9.8 Description An issue exists in an AJAX action where the software fails to perform a capability check and does not validate a nonce a unique token used to prevent replay attacks. This allows users with a Subscrib...

PT-2026-78736

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A low-privileged user without admin or power roles can...

PT-2026-80637

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

CVE-2026-20327: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

Linux Distros Unpatched Vulnerability : CVE-2026-18690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that...

CVE-2026-76365: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language SQL statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on a...