CVE-2026-66633

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66627

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

EUVD-2026-60915

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-32481

The WordPress Ezoic plugin (versions ≤ 2.22.11) contains an unauthenticated broken authentication flaw discovered by HaiND. CVSS 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) means any remote attacker can bypass authentication and access confidential data without credentials. No fix version or i...

CVE-2026-32470

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

EUVD-2026-60904

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32468

CVE-2026-32468 is an unauthenticated sensitive data exposure vulnerability in the Duitku Payment Gateway WordPress plugin, affecting versions 2.11.14 and below . The flaw allows remote attackers to access sensitive data without any prior authentication, as reflected by the CVSS 3.1 score of 7.5 (...

CVE-2026-32465

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32333

Mayosis Core WordPress plugin versions ≤5.4.7 are affected by an unauthenticated reflected Cross Site Scripting (XSS) vulnerability exploitable via network with low attack complexity; CVSS 3.1 score is 7.1 (HIGH), requiring user interaction. No patch version or in-the-wild exploitation details ar...

CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

CVE-2026-28570

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...

MINI-P342-3R8H-MHC5

Bulletin has no description...

BASM (Broken Authentication & Session Management) in Jira Data Center

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 9.12.14, 10.3.0, and 11.3.0 of Jira Software Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an...

CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

EUVD-2026-60763

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

DEBIAN-CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...