EUVD-2026-53892

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...

CVE-2026-66678 WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...

CVE-2026-66678

CVE-2026-66678 concerns a Broken Access Control issue in the WordPress plugin Advanced Custom Fields: Font Awesome Field , affecting versions up to and including 6.1.1 . The connected sources consistently describe the vulnerability class and affected plugin/version but do not provide technical de...

OPENSUSE-SU-2026:21543-1 Security update for python-Django

This update for python-Django fixes the following issues: Changes in python-Django: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997 - CVE-2026-15337: potential denial-of-service vulnerability in checkforlanguage bsc1272998 - CVE-2026-15830: potential...

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced Custom Fields: Font Awesome Field versions = 6.1.2...

CVE-2026-4427

No description is available for this CVE...

CVE-2026-18325 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18325

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18325 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

CVE-2026-67689: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

PT-2026-68779

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

PT-2026-68582

Name of the Vulnerable Software and Affected Versions Advanced Custom Fields: Font Awesome Field versions prior to 6.1.2 Description Broken access control allows contributors to perform unauthorized actions within the plugin. Recommendations Update to a version newer than 6.1.1...

PT-2026-68977

Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0...

PT-2026-68374

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.56.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a techniqu...

CVE-2026-66678: Missing Authorization

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

CVE-2026-70557: Authorization Bypass Through User-Controlled Key

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

CVE-2026-67689

A SQL Injection vulnerability exists in FineAdmin V1.0 (specifically in FineAdmin.Mvc ) due to improper neutralization of special elements in SQL commands. The BaseService.GetListByFilter() and GetPageUnite() methods directly concatenate the field and order parameters into the ORDER BY clause usi...