WordPress WPCargo Track & Trace plugin < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number vulnerability

Unauthenticated SQL Injection via wpcargotrackingnumber vulnerability discovered by Shivamani Vastrala in WordPress Plugin WPCargo Track & Trace versions 8.0.4...

CVE-2026-73386

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

CVE-2026-73386 WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

EUVD-2026-62387

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

CVE-2026-73386

The WordPress plugin "Track Geolocation Of Users Using Contact Form 7" through version 3.0.2 exposes sensitive data to unauthenticated users over the network (CVSS 7.5 HIGH, C:H/I:N/A:N). No exploitation status or remediation details are provided in the documents. Monitor for plugin updates. Patc...

CVE-2026-73386 WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nabil Irawan in WordPress Plugin Track Geolocation Of Users Using Contact Form 7 versions = 3.0.2...

CVE-2026-73386: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

GHSA-HJCP-JMPX-G3QM vulnerabilities

Vulnerabilities for packages: druid, trino, logstash, zipkin, thingsboard, apicurio-registry, kserve-modelmesh, cloudwatch-exporter, sonarqube, flyway, nrjmx, wavefront-proxy, opensearch, cassandra-reaper, akhq, dependency-track...

CVE-2026-64607 vulnerabilities

Vulnerabilities for packages: druid, trino, logstash, zipkin, thingsboard, apicurio-registry, kserve-modelmesh, cloudwatch-exporter, sonarqube, flyway, nrjmx, wavefront-proxy, opensearch, cassandra-reaper, akhq, dependency-track...

CVE-2026-54428 vulnerabilities

Vulnerabilities for packages: flyway, wso2is, traccar-fips, cassandra-reaper, wavefront-proxy, wazuh-indexer, nacos, apache-nifi, logstash, sonarqube, airbyte-server, cloudwatch-exporter, dependency-track-apiserver, apicurio-registry, airbyte-platform, apache-hop-fips, kayenta-fips, geoserver,...

GHSA-V3JC-474W-2WM6 vulnerabilities

Vulnerabilities for packages: flyway, wso2is, traccar-fips, cassandra-reaper, wavefront-proxy, wazuh-indexer, nacos, apache-nifi, logstash, sonarqube, airbyte-server, cloudwatch-exporter, dependency-track-apiserver, apicurio-registry, airbyte-platform, apache-hop-fips, kayenta-fips, geoserver,...

CVE-2026-18749 CVE-2026-18749

The type=track branch authorises on ismycasetattach.case only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has NOT been marked shared is still retrievable by any case member who has or is sent its uuid — leaks not-yet-released coordinator material to...

CVE-2026-12713

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

CVE-2026-12713

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

EUVD-2026-53734

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

CVE-2026-12713 WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

CVE-2026-12713: Improper Neutralization of Special Elements used in an SQL Command

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004...

osbuild-composer security update

175-1.0.1 - Track github upstream...

CVE-2026-67350

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y...