CVE-2026-82852

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

CVE-2026-82228

Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...

CVE-2026-82224

Unauthenticated Cross Site Scripting XSS in SliceWP = 1.2.10 versions...

CVE-2026-82221

Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82225

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82229

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

CVE-2026-82226

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-81780

Unauthenticated Arbitrary File Upload in Hash Form = 1.4.2 versions...

CVE-2026-81763

Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...

CVE-2026-81765

Unauthenticated Cross Site Scripting XSS in Tailored Tools = 3.0.2 versions...

CVE-2026-81768

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2026-81764

Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...

CVE-2026-81291

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

CVE-2026-81298

Unauthenticated Cross Site Scripting XSS in LeadConnector = 4.0.5 versions...

CVE-2026-81756

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-81293

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-81290

Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...

CVE-2026-54600

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...