JoomSport <= 5.7.7 - SQL Injection

The JoomSport WordPress plugin through 5.7.7 is vulnerable to unauthenticated time-based blind SQL injection via the 'sortf' GET parameter in the player list view. The parameter value is backtick-wrapped and directly concatenated into an ORDER BY clause. id: CVE-2026-42647 info: name: JoomSport =...

CVE-2026-55825 Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

OPENSUSE-SU-2026:21487-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...

CLEANSTART-2026-SK95653 Security fixes in kapp-controller 0.57.0-r0

Package kapp-controller version 0.57.0-r0 fixes 6 vulnerabilities: ghsa-hfvc-g4fc-pqhx, ghsa-p77j-4mvh-x3m3, ghsa-mh2q-q3fh-2475, CVE-2026-33186, CVE-2026-39883...

ROOT-OS-UBUNTU-2404-CVE-2025-71192 CVE-2025-71192 in rootio-linux - Patched by Root

Root has patched CVE-2025-71192 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

CVE-2026-65443

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

CVE-2026-65443

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

CVE-2026-65443 WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

CVE-2026-51077

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...

EUVD-2026-48180

Unauthenticated Cross Site Scripting XSS in Grand Photography = 5.7.8 versions...

CVE-2026-60557

CVE-2026-60557 affects Oracle WebCenter Sites (Oracle Fusion Middleware) in versions 12.2.1.4.0 and 14.1.2.0.0. The issue allows an unauthenticated attacker with network access over HTTP to compromise WebCenter Sites, with human interaction required for exploitation. Impact per sources: potential...

CVE-2026-60457

...

CVE-2026-47057

The CVE-2026-47057 entry concerns Oracle Java SE (Scripting) with affected versions listed as 8u491, 8u491-perf, and 11.0.31. The vulnerability is exploitable over the network via multiple protocols and can allow an unauthenticated attacker to cause a hang or crash (complete DOS). The flaw can be...

CVE-2026-51027

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component...

EUVD-2026-45990

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request...

EUVD-2026-45991

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component...

CVE-2026-57770

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through = 5.7.8...

CVE-2026-57770

The CVE-2026-57770 entry concerns Deserialization of Untrusted Data in the WordPress Theme Grand Photography plugin/theme. Affected: Grand Photography versions up to 5.7.8. Root cause: PHP object injection arising from untrusted data deserialization. Impact: high confidentiality, integrity, and a...

CVE-2026-13010

The CVE-2026-13010 entry concerns the JoomSport plugin for WordPress (Team & League, Football, Hockey & more). Affected versions: all up to and including 5.7.9. Vulnerability type: time-based SQL Injection via the 'event' shortcode attribute, caused by insufficient escaping of the user-supplied p...

EUVD-2026-42860

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribute in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient...