CVE-2026-102138 Kiteworks Core Server-Side Request Forgery (SSRF)

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...

CVE-2026-102093

Kiteworks Core versions prior to 9.5.0 are vulnerable to Improper Privilege Management due to a failure in enforcing restrictions on role assignment. This flaw allows an authenticated administrative user with limited, non-Sysadmin role-management permissions to bypass authorization limits and ele...

CVE-2026-55094

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-103474

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 Una herramienta de explotación para probar vulnerabilidades de Ejecución Remota de Código RCE en el plugin de WordPress WPCode Lite Insert Headers and Footers v2.3.5. Esta vulnerabilidad se origina al registrar el Tipo de Contenido Personalizado CPT wpcode sin definir un...

CVE-2026-96815

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

CVE-2026-96344

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

USN-8854-1 keystone vulnerabilities

Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. CVE-2026-80182 It was discovered that...

CVE-2026-96815

The Vitepos plugin for WordPress (versions

EUVD-2026-89868

Custom role Privilege Escalation in Vitepos = 3.5.0 versions...

EUVD-2026-89857

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344 WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

Custom role PHP Object Injection in eCommerce Product Catalog = 3.6.0 versions...

CVE-2026-96344

The eCommerce Product Catalog plugin for WordPress (versions

CVE-2026-96343 WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96343 WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

Custom role PHP Object Injection in WP ERP = 1.17.9 versions...

CVE-2026-96343

The WP ERP plugin for WordPress, in versions

CVE-2026-85415

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2026-85001

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...