CVE-2026-40724: Improper Limitation of a Pathname to a Restricted Directory

CP Client Arbitrary File Download in Client Portal Pro = 5.6.2 versions...

CVE-2026-40723: Missing Authorization

Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...

CVE-2026-40721: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Element Pack Pro = 9.0.6 versions...

CVE-2026-39596: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Blocksy Companion Pro 2.1.29 versions...

CVE-2026-39589: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Webenvo = 0.0.6 versions...

CVE-2026-39577: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Playroom = 1.4.1 versions...

CVE-2026-39573: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...

CVE-2026-39568: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Mr. SEO = 2.0 versions...

CVE-2026-39567: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Santé = 1.5.1 versions...

CVE-2026-39558: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Malmö = 2.2 versions...

CVE-2026-39549: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Aperitif = 1.5 versions...

CVE-2026-39548: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in MagOne = 9.0 versions...

CVE-2026-39547: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Getaway 1.8 versions...

CVE-2026-39546: Incorrect Privilege Assignment

Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...

CVE-2026-39539: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking = 2.1.2 versions...

CVE-2026-39537: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Mikado Core = 1.6 versions...

CVE-2026-39529: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Elementra = 1.0.9 versions...

CVE-2026-39438: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in ListingPro = 2.9.10 versions...

CVE-2026-39446: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...

CVE-2026-39522: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Solene = 3.4 versions...