CVE-2026-95514 WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Netgsm = 2.10.0 versions...

CVE-2026-94498

The AppMySite WordPress plugin (versions

CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94457 WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...

EUVD-2026-85470

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

USN-8807-1: Open-iSNS vulnerability

It was discovered that Open-iSNS contained a double-free vulnerability when decoding malformed iSNS attributes. An unauthenticated attacker could possibly use this to cause a denial of service...

CVE-2026-87908

A flaw was found in multiparty, a Node.js library for parsing multipart/form-data request bodies. The parser does not properly limit the memory used when accumulating headers of a single multipart part. An unauthenticated attacker can exploit this by sending a request with a large volume of heade...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

OpenJDK: Enhance HTTP Connections (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-80342

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's...

EUVD-2026-85051

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.1-8.9.4 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Directorist versions 8.1-8.9.4...

CVE-2026-84026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.1 through 8.9.4 contains a vulnerability that fails to restrict access to a REST endpoint used for returning user records. This flaw allows unauthenticated attackers to access and read private co...

WordPress divi-dash plugin < 1.0.7 - Unauthenticated Denial of Service vulnerability

Unauthenticated Denial of Service vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Divi Dash versions 1.0.7...

CVE-2026-95604: Missing Authorization

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-87978: Insufficient Verification of Data Authenticity

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment...

CVE-2026-93526: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.4 versions...

CVE-2026-17618 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization...

EUVD-2026-84423

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack...

CVE-2026-84388

A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack...