CVE-2026-9639 Authenticated Denial of Service via Malicious Backup Tarball in LXD

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with cancreatestoragevolumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expiresat snapshot field...

EUVD-2025-210353

Contributor Broken Access Control in Live Copy Paste for Elementor = 1.5.3 versions...

EUVD-2026-39650

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue...

CVE-2026-57660

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.1 versions...

CVE-2026-57649

Subscriber Broken Access Control in Shoppable Images Lite = 1.3 versions...

CVE-2026-57430

Contributor Broken Access Control in SEOPress PRO = 9.1.1 versions...

CVE-2026-57431

Author Cross Site Scripting XSS in Featured Image = 2.1 versions...

CVE-2026-57315

Contributor Remote Code Execution RCE in Blocksy Companion Pro = 2.1.45 versions...

EUVD-2026-39770

Unauthenticated Cross Site Request Forgery CSRF in Child Theme Wizard = 1.4 versions...

CVE-2026-57646 WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Majestic Support = 1.1.7 versions...

CVE-2026-57638

CVE-2026-57638 concerns a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Fluent Booking affecting versions

CVE-2026-57638 WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Fluent Booking = 2.1.0 versions...

EUVD-2026-39747

Administrator SQL Injection in Popup box = 6.0.1 versions...

CVE-2026-57631

Administrator SQL Injection in Popup box = 6.0.1 versions...

CVE-2026-57630 WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Blocksy Companion Pro = 2.1.46 versions...

EUVD-2026-39745

Contributor Cross Site Scripting XSS in StatCounter = 2.1.1 versions...

CVE-2026-57629

Contributor Cross Site Scripting XSS in StatCounter = 2.1.1 versions...

CVE-2026-57628

Administrator SQL Injection in WP All Import = 4.0.1 versions...

EUVD-2026-39744

Administrator SQL Injection in WP All Import = 4.0.1 versions...

EUVD-2026-39739

Author Cross Site Scripting XSS in Featured Image = 2.1 versions...