CVE-2026-73187: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-66641: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...

CVE-2026-73378: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-74015: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Readabler 2.0.18 versions...

CVE-2026-28569: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

CVE-2026-68565: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

CVE-2026-66651: Missing Authorization

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.19...

CVE-2026-66622: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-66620: Deserialization of Untrusted Data

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-74983: Protection Mechanism Failure

Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-5224: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data. This issue affects Cryptosim: before 3.1.0.229...

CVE-2026-74004: Missing Authorization

Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms = 6.0 versions...

CVE-2026-73399: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...

CVE-2026-73398: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...

CVE-2026-73352: Missing Authorization

Unauthenticated Broken Access Control in GiveWP = 4.16.5.1 versions...

CVE-2026-73342: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...

CVE-2026-32468: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-28571: Missing Authorization

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

CVE-2026-15585: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 befo...

CVE-2026-23922: Insufficiently Protected Credentials

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint...