CVE-2026-64806: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter...

CVE-2026-64805: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

CVE-2026-64804: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling...

CVE-2026-64803: Improper Control of Generation of Code

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK...

CVE-2026-64802: Improper Control of Generation of Code

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

CVE-2026-61973: Missing Authorization

Subscriber Broken Access Control in ShopLentor Pro = 2.8.5 versions...

CVE-2026-61954: Missing Authorization

Unauthenticated Broken Access Control in PayU India = 3.8.9 versions...

CVE-2026-61972: Missing Authorization

Unauthenticated Broken Access Control in ShopLentor Pro = 2.8.5 versions...

CVE-2026-61951: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in TrueBooker = 1.2.3 versions...

CVE-2026-61950: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in TrueBooker = 1.2.3 versions...

CVE-2026-61949: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Bookly = 27.7 versions...

CVE-2026-61948: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-59554: Weak Authentication

Unauthenticated Broken Authentication in Ziina = 1.2.21 versions...

CVE-2026-61943: Missing Authorization

Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61945: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...

CVE-2026-59555: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.3 versions...

CVE-2026-59545: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in miniOrange Discord Integration = 2.2.4 versions...

CVE-2026-59544: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...

CVE-2026-59542: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...

CVE-2026-59541: Incorrect Privilege Assignment

Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...