CVE-2026-12688

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

CVE-2026-12688: Improper Access Control

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...

CVE-2026-59540

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

CVE-2026-64810

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking...

CVE-2026-64810

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking...

CVE-2026-64810

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking...

CVE-2026-59540 WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

CVE-2026-59540

The CVE concerns WordPress plugin SMS Alert Order Notifications, affected in versions

EUVD-2026-48193

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

CVE-2026-59540 WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

CVE-2026-9729 Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter

The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushrnotificationtitle' and 'webpushrnotificationbody' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the savesendnotificationflag...

CVE-2026-9729 Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter

The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushrnotificationtitle' and 'webpushrnotificationbody' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the savesendnotificationflag...

PT-2026-63581

The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr notification title' and 'webpushr notification body' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the save send notificatio...

PT-2026-63851

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

PT-2026-63964

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking...

CVE-2026-59540: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.6 versions...

CVE-2026-9729: Improper Neutralization of Input During Web Page Generation

The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushrnotificationtitle' and 'webpushrnotificationbody' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the savesendnotificationflag...

GHSA-Q423-49RW-G9MH Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

Summary GHSA-8fwc-qjw5-rvgp "Gitea may send release notification emails for private repositories to users whose access has been revoked", fix in PR 36319 / commit 8a98ac22 added repomodel.ClearRepoWatches as a defense for the state transition public→private. The cleanup was wired into...

CVE-2026-63914

A flaw was found in the Linux kernel's xfrm and afkey modules. The xfrmsendmigrate and pfkeysendmigrate functions incorrectly hardcode the initnet initial network namespace for migration notifications. This misconfiguration leads to two main issues: migration notifications are delivered to the...

CVE-2026-65051 Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...