CVE-2026-78528: Missing Authorization

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

CVE-2026-24074: Out-of-bounds Write

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations...

CVE-2026-25284: Buffer Over-read

Information Disclosure when a pointer is reused after being deallocated...

CVE-2026-74017: Missing Authorization

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-66631: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

CVE-2026-66580: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...

CVE-2026-62104: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

CVE-2026-66572: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...

CVE-2026-92918: Insertion of Sensitive Information into Log File

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...

CVE-2026-62108: Authentication Bypass by Spoofing

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-66578: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in PropertyHive = 2.2.6 versions...

CVE-2026-25282: Out-of-bounds Read

Transient DOS when processing unverified data from a neighboring system causes out of bound memory access...

CVE-2026-66579: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...

CVE-2026-66618: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP Maps = 4.9.9 versions...

CVE-2026-69399: Unintended Proxy or Intermediary

Azure Arc Elevation of Privilege Vulnerability...

CVE-2026-25278: Time-of-check Time-of-use (TOCTOU) Race Condition

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying...

CVE-2026-78428: Session Fixation

For users authenticated through SAML or OpenID Connect OIDC, this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently...

CVE-2026-66577: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetSearch = 3.6.3 versions...

CVE-2026-66573: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...

CVE-2026-90986: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...