CVE-2026-56037: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3...

CVE-2026-42382: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Audrey = 1.5 versions...

CVE-2026-57358: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Customize My Account for WooCommerce = 4.3.9 versions...

CVE-2026-39448: Missing Authorization

Unauthenticated Broken Access Control in NOWPayments for WooCommerce = 1.4.0 versions...

CVE-2026-57348: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in Paid Member Subscriptions = 3.0.4 versions...

CVE-2026-27419: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Zegen = 1.1.9 versions...

CVE-2026-27414: Deserialization of Untrusted Data

Contributor PHP Object Injection in Werkstatt = 4.8.3 versions...

CVE-2026-27412: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Pearl - Corporate Business = 3.4.10 versions...

CVE-2026-27408: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in imithemes NativeChurch nativechurch allows Reflected XSS.This issue affects NativeChurch: from n/a before 4.9.5...

CVE-2026-27404: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in LMS = 9.7 versions...

CVE-2025-69156: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Kids Zone - Children WordPress Theme = 5.4 versions...

CVE-2025-69155: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Fitness Zone WordPress Theme = 5.7 versions...

CVE-2025-69154: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SpaLab | Beauty Salon WordPress Theme = 6.7 versions...

CVE-2025-69133: Improper Control of Filename for Include/Require Statement in PHP Program

Subscriber Local File Inclusion in Tourmaster = 5.4.5 versions...

CVE-2025-69132: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in Corpkit = 1.0.5 versions...

CVE-2025-69094: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Unicamp = 2.2.2 versions...

CVE-2025-58902: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Lighthouse = 1.2.12 versions...

UBUNTU-CVE-2026-20217

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in...

CVE-2026-57731: Missing Authorization

Contributor Broken Access Control in Flatsome = 3.20.5 versions...

CVE-2026-57265: Improper Validation of Array Index

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...