PT-2026-104118

Name of the Vulnerable Software and Affected Versions Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions prior to 3.2.7 Description An issue exists that allows authenticated attackers with subscriber-level access and above to expose sensitive information. By utilizi...

PT-2026-104077

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...

PT-2026-104144

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on the...

PT-2026-104336

Name of the Vulnerable Software and Affected Versions Divi Membership versions prior to 2.2.1 Description An issue exists in the dmem form submit handler function that allows unauthenticated attackers to escalate privileges. The function determines a new user's role by iterating through all...

PT-2026-104078

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 Description An issue exists in the Register & Login add-on where the before email success msg function, during the register login action='update' flow, trusts a user-supplied use...

tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

CVE-2026-56662

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

EUVD-2026-91018

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...

WordPress Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget vulnerability

Authenticated Subscriber+ Sensitive Information Exposure in Form Submissions Dashboard Widget vulnerability discovered by Jakub Herman in WordPress Plugin Otter - Gutenberg Block versions = 3.2.6...

PYSEC-2026-4157 pypdf: Possible long runtimes when generating appearance streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider...

pypdf: Possible long runtimes when generating appearance streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. PatchesThis has been fixed in pypdf==6.19.0. WorkaroundsIf you cannot upgrade yet, consider...

tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass

A flaw was found in Apache Tomcat. This incorrect authorization vulnerability occurs within the FORM authentication process, allowing a user to bypass security constraints. This bypass enables unauthorized access to resources via a GET request, even when those resources are intended to be...

GHSA-PHP9-FJ8V-98FJ pypdf: Possible long runtimes when generating appearance streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires updating form field values with flattening enabled, which triggers appearance stream generation. Patches This has been fixed in pypdf==6.19.0. Workarounds If you cannot upgrade yet, consider...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Glpi-Project Glpi

CVE-2026-26026 — GLPI Form Dropdown SSTI PoC Authenticated SS...

CVE-2026-62058

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

EUVD-2026-90810

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058

The WordPress CF7 Apps plugin (versions

WordPress Business Essentials for Contact Form 7 plugin <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Contact Form 7 Redirect & Thank You Page versions = 1.2.1...