WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ian Ho Shim in WordPress Plugin Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions = 1.7.1...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cert-manager, gitlab-kas, kubernetes-csi-external-attacher, kubernetes-csi-external-health-monitor, keda, cluster-api-ipam-provider-in-cluster, kyverno, kuma, cloud-provider-aws, datadog-agent, cluster-autoscaler, crossplane, flux-notification-controller,...

CVE-2026-18430

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-18430 HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

EUVD-2026-62546

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-18430

HumHub 1.18.4's comment-deletion notification flow does not sanitize the administrator-supplied reason, allowing stored XSS when the original author views the notification. A Space admin can inject HTML/JavaScript targeting another user. CVSS 7.2 (HIGH) reflects network access with high privilege...

CVE-2026-18430 HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-18430 HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-75952 Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

SummaryRepo under test: https://github.com/Netflix/lemurThe certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...

CVE-2026-18777

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

CVE-2026-14826

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

EUVD-2026-62282

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

CVE-2026-18777

The TrueBooker WordPress plugin (versions before 1.2.7 ) is vulnerable to an unauthenticated arbitrary appointment status change due to improper authorization checks in an AJAX action (specifically the update_appointment_status functionality). An unauthenticated attacker can exploit this flaw to ...

CVE-2026-18777 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

EUVD-2026-62209

Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...

PT-2026-78296

Name of the Vulnerable Software and Affected Versions TrueBooker versions prior to 1.2.7 Description Insufficient authorization checks in an AJAX action allow unauthenticated users to modify the status of arbitrary appointments. This flaw also enables the triggering of notification emails to the...

CVE-2026-18430: Improper Neutralization of Input During Web Page Generation

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

PT-2026-78489

Name of the Vulnerable Software and Affected Versions HumHub version 1.18.4 Description A stored cross-site scripting issue exists in the comment-deletion notification flow. A Space administrator can exploit this by deleting another user's comment and inserting HTML or JavaScript into the deletio...

CVE-2026-18777: Missing Authorization

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...