CVE-2026-24552

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

ImpactLiteLLM's MCP Streamable HTTP endpoint could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.The MCP auth handler supported OAuth2 passthrough for upstream MCP servers, but the fallback path could replace failed LiteLLM key...

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

ImpactDatadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage...

CVE-2026-65550 WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...

EUVD-2026-48142

Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...

CVE-2026-65538 WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in Machete = 5.2 versions...

CVE-2026-65538

CVE-2026-65538 : WordPress Machete plugin ≤ 5.2 contains a Cross Site Scripting (XSS) vulnerability in the author context. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The provided documents do not specify the exact vulnerable component, explo...

EUVD-2026-48139

Author Cross Site Scripting XSS in Machete = 5.2 versions...

CVE-2026-65538

Author Cross Site Scripting XSS in Machete = 5.2 versions...

EUVD-2026-48134

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

EUVD-2026-48133

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-65532

CVE-2026-65532 concerns the WordPress Persian Woocommerce SMS plugin, affected

EUVD-2026-48131

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

CVE-2026-65530

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

CVE-2026-65525 WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi Framework = 2.2.0 versions...

CVE-2026-65524 WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...

EUVD-2026-48120

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65510

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65494 WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability

Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65494

CVE-2026-65494 affects WordPress via the Dokan Pro plugin ≤ 5.0.2, with a Subscriber SQL Injection vulnerability. The connected data confirms the affected component and the vulnerability class (SQL injection) but does not provide exploit details, affected tables/parameters, or a patch/version to ...