CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

EUVD-2026-60890

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

WordPress Eventin plugin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting vulnerability

Editor+ Local File Inclusion via speakertemplate Setting vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress GeoDirectory plugin < 2.8.110 - Editor+ Stored XSS via Place Categories vulnerability

Editor+ Stored XSS via Place Categories vulnerability discovered by Krugov Artyom in WordPress Plugin GeoDirectory versions 2.8.110...

WordPress SureDash plugin <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SureDash versions = 1.10.3...

BIT-GITLAB-2026-8667 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

BIT-GITLAB-2026-4879 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to...

BIT-GITLAB-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

BIT-GITLAB-2025-9486 Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

WordPress ECS plugin < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability

Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability discovered by Shivamani Vastrala in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...

WordPress WPML Multilingual CMS plugin <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter vulnerability

Authenticated Translator+ SQL Injection via 'sorting' Parameter vulnerability discovered by momopon1415 in WordPress Plugin Multilingual CMS versions = 4.9.5...

ANT-2026-SXD0NN2P · supabase/supabase · SQL Injection

sql-injection high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-SXD0NN2P: Link-driven SQL injection via table-editor filter ARRAY bypass The Supabase Studio Table Editor...

PT-2026-77041

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

PT-2026-77050

Name of the Vulnerable Software and Affected Versions Templatiq versions prior to 0.2.6 Description An issue allows contributors to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the system. Recommendations Update to a version newer than 0.2.5...

Typemill 2.25.0 Authorization Bypass

Typemill version 2.25.0 and below contains an authorization bypass vulnerability in role-restricted media downloads. The application performs its authorization check using the raw request path while accessing the file using the filesystem-resolved path. An unauthenticated remote attacker can use...

PT-2026-77128

Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...

PT-2026-80270

Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validate revocation url in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...