CVE-2026-15237 Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

CVE-2026-65520

Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...

WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin FluentForm versions = 6.2.8...

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.21.1...

UBUNTU-CVE-2026-61372

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue...

EUVD-2026-52338

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 6.2.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Talal Nasraddeen in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...

CLEANSTART-2026-OM19223 Security fixes in redis 6.2.0-r0

Package redis version 6.2.0-r0 fixes 2 vulnerabilities: CVE-2021-21309, CVE-2021-3470...

CVE-2026-3158 Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to an information disclosure due to sensitive information being...

CVE-2026-12800

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

[SECURITY] Fedora 44 Update: rpm-6.0.2-1.fc44

The RPM Package Manager RPM is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Each software package consists of an archive of files along with information about the package like its version, a...

EUVD-2026-49210

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-61948

Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61948

WordPress WPDM – Premium Packages plugin ≤ 6.2.0 is affected by unauthenticated SQL injection. The vulnerability is documented in CVE-2026-61948 with a CVSS v3.1 base score of 9.3 (CRITICAL) and a network attack vector, no privileges required, no user interaction. Details indicate the issue is an...

CVE-2026-61943

CVE-2026-61943 describes an unauthenticated Broken Access Control in the WordPress WPDM – Premium Packages plugin, affected versions

PT-2026-63860

Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...

CVE-2026-61185

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Installation. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment...

CVE-2026-61182

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Data Import. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Agile...

MiracleLinux 9 : redis-6.2.22-1.el9_8 (AXSA:2026-1300:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1300:02 advisory. redis: RESTORE invalid memory access may allow remote code execution CVE-2026-25243 Tenable has extracted the preceding description block directly from the...

WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by HieuPenguinnn in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...