CVE-2026-12723

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation...

EUVD-2026-45884

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory...

CVE-2026-12723 Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation...

CVE-2026-12723

CVE-2026-12723 affects the Kirki WordPress plugin (pre-6.0.12). The vulnerability is due to a missing authorization check on a REST route, enabling unauthenticated users to overwrite content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing com...

CVE-2026-12898

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory...

CVE-2026-12898

CVE-2026-12898 affects the All-in-One WP Migration and Backup WordPress plugin prior to 7.106. The root cause is improper sanitisation of a user-supplied value used to build a file path, enabling path traversal to create or append a log file in arbitrary locations outside the intended storage dir...

CVE-2026-12724

The Kirki WordPress plugin (pre-6.0.12) is affected by an HTML injection in the password-reset email: unsigned/unsanitized email subject/body values allow unauthenticated users to inject HTML into the delivered message, enabling phishing. Root cause: lack of sanitization/escaping in the password-...

EUVD-2026-45882

The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation...

CVE-2026-11868

CVE-2026-11868 concerns the WordPress plugin WP Travel (before version 11.7.1). The issue is that the plugin does not perform capability or ownership checks on its booking cancellation action, which is exposed to unauthenticated users, allowing them to cancel arbitrary bookings on affected sites....

CVE-2026-11349

The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...

CVE-2026-11868 WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site...

EUVD-2026-45880

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site...

CVE-2026-11349

The CVE concerns the Modern Event Calendar plugins for WordPress (Pro and Lite) before version 7.34.0, where an unauthenticated AJAX action uses an unsanitized request parameter in a SQL statement, causing an unauthenticated SQL injection. Root cause: lack of sanitization/escaping of the paramete...

CVE-2026-11868

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site...

EUVD-2026-45877

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

CVE-2026-10724

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

CVE-2026-10724 Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service DoS condition. The lack of limits or throttling mechanisms enables an...

PT-2026-61583

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature...

PT-2026-61563

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description A denial of service issue exists in the RPC use handler that causes a panic when the db variable is set without a namespace. Unauthenticated attackers can crash the server process by sending a...