CVE-2026-74006

Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...

CVE-2026-73996

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73380

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73367

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73361

Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...

CVE-2026-73356

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-32481

Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...

CVE-2026-32473

Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...

mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and...

mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

CVE-2026-75898

RAGFlow before 0.26.3 lacks URL validation in the agent Invoke component (agent/component/invoke.py), allowing low-privilege users to force the server to fetch internal metadata endpoints and return responses. Patch is available in v0.26.3. Exploitation details are not provided in the documents.

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

MINI-75HM-F2F3-M8WR

Bulletin has no description...

CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

CVE-2026-74008

The WordPress "Shortcodes and extra features for Phlox theme" plugin (auxin-elements) version 2.17.22 and earlier exposes sensitive data without authentication, rated CVSS 5.3 (MEDIUM). CISA SSVC shows no known exploitation. No patch version is mentioned in the provided documents; update to a new...

CVE-2026-74006 WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability

Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...

CVE-2026-73997 WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP = 2.3.3 versions...

EUVD-2026-60804

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...