CVE-2026-66774

creationtimestamp| type| source ---|---|--- 2026-08-13 08:48:19+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0998...

CVE-2026-19481

Summary: CVE-2026-19481 affects the multipart-form data parser in the @fastify/busboy package (versions 1.0.0–3.2.0). An attacker can submit multipart data with a part header named after a prototype-inherited property (e.g., proto , constructor), causing the header parser (which stores headers in...

WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin OMGF Pro versions = 5.2.7...

EUVD-2026-57736

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-3835

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...

CVE-2026-13610

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff doctor account with full access to patient records, billing and clinic data...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-13328

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept PoC code. The vulnerability in question is CVE-2026-55040 CVSS score: 9.1, which refers to a critical security feature bypass that stems from weak authentication. I...

CVE-2026-18945

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945

CVE-2026-18945 concerns the WP Helper Premium WordPress plugin (before 4.7.6). The root cause is missing verification of the order key when rendering the custom order confirmation page and handling related AJAX actions, which allows unauthenticated users to view other customers’ order details (in...

EUVD-2026-57728

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

EUVD-2026-57726

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-13610

Summary of findings (CVE-2026-13610) : The WordPress plugin KiviCare (versions

CVE-2026-13610 KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff doctor account with full access to patient records, billing and clinic data...

CVE-2026-13328

The CVE-2026-13328 affects the Food Menu WordPress plugin (TLP Food Menu – Restaurant Menu & Online Ordering for WooCommerce) prior to 6.0.2. The reservation-status update action lacks any capability/ownership checks and is exposed to unauthenticated users, protected only by a publicly available ...

CVE-2026-13328 TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...

CVE-2026-13328

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...

CVE-2026-14182

The CVE-2026-14182 affects the Customer Email Verification for WooCommerce WordPress plugin prior to 3.2.6. The vulnerability stems from incorrect validation of the email-verification activation code, using a loose (type-j juggling) comparison that a crafted value can satisfy. This allows unauthe...