CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...

EUVD-2026-63343

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

CVE-2026-66593

CVE-2026-66593 is an unauthenticated SQL injection vulnerability in the WordPress plugin Security & Malware scan by CleanTalk , affecting versions ≤ 2.184 . The flaw allows a remote attacker to execute arbitrary SQL queries without authentication, leading to high confidentiality impact and low av...

CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...

CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2025-15688 WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Capella = 2.5.5 versions...

EUVD-2025-210756

Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...

CVE-2026-77084 n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values

n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1 contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value wou...

CVE-2026-77066

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...

CVE-2026-77026

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-73198

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...

CVE-2026-73198 Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...

EUVD-2026-63244

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...

CVE-2026-73198

FreeIPA is vulnerable to an unauthenticated denial-of-service via the /ipa/i18n_messages endpoint. A remote attacker can send an arbitrarily large request body, causing memory exhaustion and service degradation. The root cause is an unbounded request body read with no size limit enforced. CVSS 3....

CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-77026

Convert Forms (by tassos.gr) for Joomla , versions below 5.2.5 , is affected by a client-controlled validation bypass. The front-end Submissions view did not enforce access control, allowing an unauthenticated visitor to list a form's submissions. The CVSS 4.0 base score is 6.9 (MEDIUM) , with a ...

EUVD-2026-63242

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

EUVD-2026-63240

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...