CVE-2026-81764

Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...

CVE-2026-81298

Unauthenticated Cross Site Scripting XSS in LeadConnector = 4.0.5 versions...

CVE-2026-81291

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

CVE-2026-81756

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81293

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-81290

Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...

CVE-2026-54600

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...

CVE-2026-54598

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite...

CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...

CVE-2026-77348

Wallos , an open-source self-hostable subscription tracker, ships a second unauthenticated logo-image search endpoint—endpoints/payments/search.php—that was missed when the original httpoxy SSRF fix (CVE-2026-33407) hardened endpoints/logos/search.php. Prior to version 5.0.0 , the endpoint passes...

CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...

CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

CVE-2026-54600

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4 , the endpoints/db/import.php endpoint lacks authentication. The only protective guard is a check on the user-table row count: if the count is zero (as in a fresh or unconfigured install ), an unauthenti...

CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...

CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...

CVE-2026-82229

An unauthenticated Cross Site Scripting (XSS) vulnerability affects the WordPress Social Login and Register plugin in versions 7.8.2 and earlier . The flaw was discovered by Patchstack researcher Ananda Dhakal and carries a CVSS 3.1 score of 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L...