CVE-2026-64803: Improper Control of Generation of Code

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK...

CVE-2026-65533: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

CVE-2026-65500: Missing Authorization

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-59524: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Easy Digital Downloads = 3.6.7 versions...

CVE-2026-65530: Missing Authorization

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

CVE-2026-61973: Missing Authorization

Subscriber Broken Access Control in ShopLentor Pro = 2.8.5 versions...

CVE-2026-57703: Missing Authorization

Subscriber Broken Access Control in Sunshine Photo Cart = 3.6.10.1 versions...

CVE-2026-59526: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-65473: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12 versions...

CVE-2026-65474: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

CVE-2026-27355: Missing Authorization

Unauthenticated Broken Access Control in Ditty = 3.1.66 versions...

CVE-2026-65525: Missing Authorization

Unauthenticated Broken Access Control in Civi Framework = 2.2.0 versions...

CVE-2026-59525: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

CVE-2026-27391: Missing Authorization

Subscriber Broken Access Control in uListing = 2.2.0 versions...

CVE-2026-65462: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...

CVE-2026-65499: Missing Authorization

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-52688: Improper Certificate Validation

RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation...

CVE-2026-65451: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-57769: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Grand Photography = 5.7.8 versions...

CVE-2026-65471: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...