Giga Messenger WordPress - Cross-Site Scripting

Giga Messenger WordPress plugin = 2.3.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

Astra Linux – Vulnerability in gpac

NULL pointer dereferencing in the GitHub repository gpac/gpac before 2.3-DEV...

CVE-2026-66685

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-66706

CVE-2026-66706 affects the WordPress plugin “Subscribe to Comments” (versions

CVE-2026-66706

Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...

EUVD-2026-53909

Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...

CVE-2026-66685

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

CVE-2026-18817

CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...

CLSA-2026-1780966317 TuxCare security update for io.undertow:undertow-core (4 CVEs)

TuxCare rebuilt io.undertow:undertow-core to address 4 CVEs. Fixed in 2.3.0.Final-tuxcare.1...

CLSA-2026-1778805973 TuxCare security update for picomatch (2 CVEs)

TuxCare rebuilt picomatch to address 2 CVEs. Fixed in 2.3.1-tuxcare.1...

CLSA-2026-1775003174 TuxCare security update for underscore.string (1 CVE)

TuxCare rebuilt underscore.string to address 1 CVE. Fixed in 2.3.3-tuxcare.1...

CLSA-2026-1772928825 TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 2.3.3-tuxcare.1...

CLSA-2026-1771546208 TuxCare security update for braces (1 CVE)

TuxCare rebuilt braces to address 1 CVE. Fixed in 2.3.2-tuxcare.1...

CLSA-2025-1760313987 TuxCare security update for org.springframework.webflow:spring-webflow (2 CVEs)

TuxCare rebuilt org.springframework.webflow:spring-webflow to address 2 CVEs. Fixed in 2.3.1.RELEASE-tuxcare.1...

WordPress Travel & Tours Meta Search plugin <= 2.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by CraCkEr in WordPress Plugin Flights & Hotels Booking WP Plugin versions = 2.3...

WordPress Travel & Tours Meta Search plugin <= 2.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by CraCkEr in WordPress Plugin Flights & Hotels Booking WP Plugin versions = 2.3...

PT-2026-67131

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

PT-2026-67074

Name of the Vulnerable Software and Affected Versions Nex Forms – Ultimate Form Builder – Lite versions prior to 9.2.4 Description An arbitrary file deletion issue exists due to path traversal. The delete file AJAX handler retrieves a file path from the database and passes it to the unlink functi...

SUSE CVE-2026-35599

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an On loop that advances a date by the task's RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far ...