CVE-2026-14601

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

EUVD-2026-63816

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-14601 Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...

CVE-2026-14601

The Link Whisper Free WordPress plugin before 0.9.7 contains a SQL injection vulnerability caused by improper sanitization and escaping of the domain parameter before it is used in a SQL query. Authenticated users with the Editor role or above can exploit this to execute arbitrary SQL commands, r...

EUVD-2026-63206

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...

CVE-2026-74992 Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...

CVE-2026-72585

An authorization bypass in Grafana allows Editor-role users to delete protected contact points because a previous security patch for updating them missed the deletion process. Mitigation To mitigate this issue grant the Editor role only to trusted users and restrict access to the Grafana UI/API t...

Linux Distros Unpatched Vulnerability : CVE-2026-72585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required...

CVE-2026-72585

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...

CVE-2026-72585

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

CVE-2026-72585

...

CVE-2026-72585

Summary: CVE-2026-72585 affects Grafana up to version 13.2.0. An Editor-role user can delete protected contact points (receivers) because the DELETE path in receiver services was not updated with the protected-field check, even though CVE-2026-21724’s fix addressed only the UPDATE code path in th...

CVE-2026-72585

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

EUVD-2026-55221

An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...

CVE-2026-16065

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

CVE-2026-16065

CVE-2026-16065 affects the Welcart e-Commerce WordPress plugin prior to 2.11.32. The issue is a lack of sanitisation of a value from an imported CSV file used in a SQL statement, enabling SQL injection by users with Editor role or higher (including custom shop-management roles). Reported CVSSv3.1...

CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import

The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...

EUVD-2026-53726

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16954

The CVE concerns the AI Engine WordPress plugin prior to version 3.6.4. The vulnerability stems from not redacting secret configuration values before they are exposed in an admin page’s inline script data, enabling users with the Editor role to read stored third-party API keys and authentication ...

CVE-2026-16954 AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...