CVE-2026-15599: Unverified Ownership

Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-domain-joiner: before 0.5.5...

CVE-2026-66690: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...

CVE-2026-66701: Missing Authorization

Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...

CVE-2026-66452: Missing Authorization

Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei = 1.0.13 versions...

CVE-2026-65547: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-65560: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-66685: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-28179: Improper Neutralization of Input During Web Page Generation

Shop manager Cross Site Scripting XSS in FiboSearch = 1.33.0 versions...

CVE-2026-65574: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Abogado = 1.18 versions...

CVE-2026-34502: Heap-based Buffer Overflow

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...

CVE-2024-8995: Insufficient Session Expiration

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials clie...

CVE-2026-28082: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

CVE-2026-28005: Missing Authorization

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...

CVE-2026-66712: Missing Authorization

Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...

CVE-2026-66699: Missing Authorization

Custom role Broken Access Control in Dokan = 5.0.10 versions...

CVE-2026-66694: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Thrive Architect = 10.9.3.1 versions...

CVE-2026-66688: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...

CVE-2026-66664: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.0 versions...

CVE-2026-66451: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...

CVE-2026-65556: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...