CVE-2026-19034 Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function newqoslimitstop of the file /tmp/qoslimittcstop.sh. Executing a manipulation of the argument waniface can lead to os command injection. The attack can be launched remotely. The exploit has be...

CVE-2025-15039 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...

CVE-2025-15039 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16537 Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

CVE-2026-11588

The EONSR AEO Agent WordPress plugin (versions

CVE-2026-16954

The AI Engine WordPress plugin (versions prior to 3.6.4 ) contains a sensitive information disclosure vulnerability. The plugin fails to redact secret configuration values before exposing them within an admin page's inline script data . This flaw allows users with the Editor role to read stored t...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

EUVD-2026-53726

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-18400 Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-18325

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-68732

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.18.0 Description The Workspace Save API endpoint accepts a workspace identifier from any authenticated user without verifying workspace ownership. This allows an attacker to modify private workspaces belonging to...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-2998)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-3048)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

PT-2026-68600

Name of the Vulnerable Software and Affected Versions Facebook for WooCommerce versions prior to 3.7.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Facebook fo...

CVE-2026-47185: Incorrect Authorization

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-14812: Hidden Functionality

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker...

PT-2026-68579

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.80 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendation...

PT-2026-68599

Name of the Vulnerable Software and Affected Versions Subscribe to Comments versions prior to 2.3.2 Description An Author Cross Site Scripting XSS issue exists in the Subscribe to Comments plugin. Cross Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages...

PT-2026-68402

Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.6.4 Description The AI Engine WordPress plugin fails to redact secret configuration values before exposing them within an admin page's inline script data. This allows users with the Editor role to access the site'...