CVE-2026-84773: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2026-84769: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

CVE-2026-84766: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...

CVE-2026-84765: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-84763: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...

CVE-2026-84762: External Control of Assumed-Immutable Web Parameter

Unauthenticated Bypass Vulnerability in WP EasyPay = 4.5.3 versions...

CVE-2026-84756: Incorrect Privilege Assignment

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-9853: Incorrect Implementation of Authentication Algorithm

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

CVE-2026-79679: Use of Weak Credentials

Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0...

CVE-2026-76178: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...

CVE-2021-38489: Plaintext Storage of a Password

HDD password plaintext is stored in a UEFI variable...

CVE-2026-85309: Missing Authorization

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...

CVE-2026-84767: Insufficient Verification of Data Authenticity

Unauthenticated Bypass Vulnerability in BookIt = 2.6.0.3 versions...

CVE-2026-84768: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

CVE-2026-85305: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...

CVE-2026-85304: Missing Authorization

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

CVE-2026-84779: Missing Authorization

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

CVE-2026-85458: Divide By Zero

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

CVE-2026-76175: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

CVE-2026-84971: Reachable Assertion

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...