CVE-2026-42055 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives are used to proxy HTTP/2 traffic, the ignoreinvalidheaders directive is set to off, and the...

EUVD-2026-37718

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives are used to proxy HTTP/2 traffic, the ignoreinvalidheaders directive is set to off, and the...

CVE-2026-54192

Unauthenticated Cross Site Scripting XSS in Popup box = 6.2.9 versions...

CVE-2026-52696

Unauthenticated Sensitive Data Exposure in JetBlog = 2.4.8 versions...

CVE-2026-49071

Unauthenticated Broken Authentication in WooCommerce Dropshipping = 5.2.4 versions...

CVE-2026-49058

Unauthenticated Privilege Escalation in LoginPress Pro = 6.2.2 versions...

CVE-2026-40723

Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...

CVE-2026-40735

Unauthenticated PHP Object Injection in Reina = 2.1 versions...

CVE-2026-39595

Author Broken Access Control in W3 Total Cache = 2.9.1 versions...

CVE-2026-39568

Unauthenticated Local File Inclusion in Mr. SEO = 2.0 versions...

CVE-2026-39558

Unauthenticated Local File Inclusion in Malmö = 2.2 versions...

CVE-2026-39546

Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...

CVE-2026-22328

Unauthenticated Cross Site Scripting XSS in Auto Repair = 22.6 versions...

CVE-2025-69168

Unauthenticated Local File Inclusion in Spike = 1.2 versions...

CVE-2025-69107

Unauthenticated Local File Inclusion in Rosaleen = 2.8 versions...

CVE-2025-60205

Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1...

CVE-2025-60229 WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0...

CVE-2025-60229

The CVE concerns the WordPress Lagom theme (versions

WordPress Visual Link Preview plugin <= 2.3.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by she11f in WordPress Plugin Visual Link Preview versions = 2.3.1...

EUVD-2026-37699

Unauthenticated Local File Inclusion in Kastell = 2.0 versions...