CVE-2026-28002: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-27539: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27535: Missing Authorization

Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...

CVE-2026-28008: Authentication Bypass by Spoofing

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...

CVE-2026-18020: Out-of-bounds Read

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking...

CVE-2026-17476: Out-of-bounds Write

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write...

CVE-2026-73479: Improper Encoding or Escaping of Output

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...

CVE-2026-66467: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in FluentCommunity = 2.7.5 versions...

CVE-2026-66465: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Cartify = 1.3.0.1 versions...

CVE-2026-66464: Missing Authorization

Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...

CVE-2026-66462: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...

CVE-2026-66461: Missing Authorization

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce = 1.0.5 versions...

CVE-2026-66449: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66436: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Active Products Tables for WooCommerce = 1.1.1 versions...

CVE-2026-66441: Missing Authorization

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

CVE-2026-66432: Exposure of Sensitive System Information Due to Uncleared Debug Information

Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...

CVE-2026-66430: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66424: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-65580: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...

CVE-2026-61967: Weak Password Recovery Mechanism for Forgotten Password

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...