EUVD-2026-75241

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

PT-2026-89655

Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes email/registration validation, password reset, and persistent login in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued fo...

PT-2026-89261

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

ROS-20260910-73-0142

The vulnerability of the composerlayoutmodified function in the MP4Box utility of the GPAC multimedia platform, which relates to the issue of handling incorrect XMT scenes by resetting the null pointer, allows a malicious actor to trigger a service failure...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

DEBIAN-CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

EUVD-2026-75108

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147

FreeIPA/IdM is affected by a DOM Cross-Site Scripting (XSS) vulnerability in the Web UI password reset page . An unauthenticated remote attacker can entice a victim to click a specially crafted link and complete a password reset, injecting and executing arbitrary JavaScript within the victim's au...

CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability

Subscriber+ Banner Settings Overwrite and A/B Test Data Reset vulnerability discovered by RIA Labs in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-82185

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

CVE-2026-13144

The WP Travel WordPress plugin, in versions prior to 12.0.2 , contains a vulnerability where it fails to properly verify authorization within one branch of its bank-deposit handler . This flaw allows an unauthenticated attacker who possesses a target customer's email address to reset that booking...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

EUVD-2026-74698

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset vulnerability

Unauthenticated Arbitrary Booking Payment Reset vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...

Linux Distros Unpatched Vulnerability : CVE-2026-18147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password...