CVE-2026-57340

Unauthenticated Broken Access Control in Japanized For WooCommerce = 2.9.12 versions...

CVE-2026-57338 WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

CVE-2026-57338

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

EUVD-2026-40109

Unauthenticated Cross Site Scripting XSS in ARForms = 7.1.2 versions...

CVE-2026-57336

Unauthenticated Cross Site Scripting XSS in Jobify = 4.3.2 versions...

CVE-2026-57336 WordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Jobify = 4.3.2 versions...

CVE-2026-57336

CVE-2026-57336 affects the WordPress Jobify theme up to version 4.3.2 and is an unauthenticated Cross-Site Scripting (XSS) vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network access with low attack complexity, no privileges required, user interaction needed,...

EUVD-2026-40103

Subscriber Broken Access Control in Wallet System for WooCommerce = 2.7.6 versions...

CVE-2026-57328 WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.22 versions...

CVE-2026-57328 WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.22 versions...

CVE-2026-46215

creationtimestamp| type| source ---|---|--- 2026-06-29 12:49:04+00:00| seen| https://bsky.app/profile/linkersec.bsky.social/post/3mpgjkues7s2o 2026-06-29 12:49:24+00:00| seen| https://bsky.app/profile/linkersec.bsky.social/post/3mpgjlgty6s2o 2026-06-29 18:08:50+00:00| seen|...

CVE-2026-40523

CVE-2026-40523 affects FrontAccounting

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-7246)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-7246 DESCRIPTION: Pallets Click, versions 8.3.2...

WordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Werkstatt versions = 4.7.2...

CVE-2026-13553

creationtimestamp| type| source ---|---|--- 2026-06-29 11:51:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpggeworr225 2026-06-29 14:06:08+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpgnuv2el52b...

PYSEC-2026-434 Remote unauthenticated attackers able to upload files in Onionshare

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality...

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

The nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a displaydata outpu...

django-s3file is vulnerable to relative path traversal

ImpactS3FileMiddleware is vulnerable to relative path traversal attacks, where an attacker can use a modified request to escape pre-signed upload locations and have the Django application load files from random locations into request.FILESDepending on how files are handled, this may lead to...

PYSEC-2026-401 parisneo/lollms vulnerable to stored XSS in the social feature

A Stored Cross-Site Scripting XSS vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the...

PYSEC-2026-533 Sentry: Improper authentication on SAML SSO process allows user identity linking

Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same...