Giga Messenger WordPress - Cross-Site Scripting

Giga Messenger WordPress plugin = 2.3.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

Joplin 3.3.3 Server - Privilege Escalation

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/-id t...

CVE-2026-18478

Magnolia CMS is affected by a Stored XSS in the import functionality (CVE-2026-18478). An attacker with editor privileges can inject arbitrary HTML/JavaScript into the name of an uploaded image, which is rendered/executed when the image is opened. The issue is fixed in Magnolia CMS version 6.3.10...

CVE-2026-18464

CVE-2026-18464 affects the WP MAPS PRO WordPress plugin before version 6.1.3. Affected: an AJAX action does not perform a capability check and is accessible to unauthenticated users, allowing them to trigger an operation that can recurse indefinitely, exhausting server resources and causing a Den...

Security Bulletin: Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path

Summary Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can...

CVE-2026-66685

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...

CVE-2026-66706

Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...

CVE-2026-66706

CVE-2026-66706 affects the WordPress plugin “Subscribe to Comments” (versions

EUVD-2026-53909

Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

CLSA-2026-1785954263 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.9...

EUVD-2026-53341

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

CVE-2026-18817

CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...

CLSA-2026-1783386123 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 5.3.31-tuxcare.6...

PT-2026-67131

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

Atlassian Confluence 9.0.1 / 9.1.x / 9.2.x < 9.2.17 / 9.3.1 / 9.4.x / 9.5.1 / 10.0.2 / 10.1.x / 10.2.x < 10.2.7 (CONFSERVER-104334)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104334 advisory. - This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and...

CLEANSTART-2026-BB26789 Security fixes in spark-operator 2.3.0-r3

Package spark-operator version 2.3.0-r3 fixes 4 vulnerabilities: CVE-2026-32281, CVE-2026-32288, CVE-2026-32289, CVE-2026-32280...

EUVD-2026-50965

A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial ...

CVE-2026-67245 A path traversal vulnerability was found in the VPN Clients on the ADM

A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path. An authenticated attacker can exploit this issue to write an...