CVE-2026-39657

CVE-2026-39657 concerns a missing authorization vulnerability in the WordPress WordPress plugin family “leadlovers forms” (leadlovers-forms). The vulnerability is described as Broken Access Control caused by incorrectly configured access control security levels, allowing exploitation of missing a...

PT-2026-31226

CVE-2026-39664 Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadre… https://t.co/alTd4vRrt7...

PT-2026-31214

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through = 1.0.2...

PT-2026-31220

Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through = 1.0.2...

WordPress plugin Leadrebel 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...

MAL-2026-2267 Malicious code in monolith-twirp-partitioning-pull_requests (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4214957e3e8849b6df7eb3bbd1b2c6e547fe8aa2c590a8a3a644e7d6ea8d73ed The OpenSSF Package Analysis project identified 'monolith-twirp-partitioning-pullrequests' @ 1.0.2 rubygems as malicious. It is considered...

MAL-2026-2263 Malicious code in monolith-twirp-reposinsights-reposinsights (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 49ad89ab960db3d5775dcbda83df2d42c9b3ccb2e799c7ee83729e6451b94e02 The OpenSSF Package Analysis project identified 'monolith-twirp-reposinsights-reposinsights' @ 1.0.2 rubygems as malicious. It is considered...

MAL-2026-2259 Malicious code in monolith-twirp-loops-core (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d4a98f58930eb7f736a5c69a6cf5de5b6dd033785255d4d55ae1da5a5866629 The OpenSSF Package Analysis project identified 'monolith-twirp-loops-core' @ 1.0.2 rubygems as malicious. It is considered malicious because: -...

MAL-2026-2082 Malicious code in unhandledrejection1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f2b4dcba608cf46c9d933fd9af75d42e1f10758f11890ea7afa67460e5c3ce1 The package unhandledrejection1 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in unhandledrejection1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f2b4dcba608cf46c9d933fd9af75d42e1f10758f11890ea7afa67460e5c3ce1 The package unhandledrejection1 was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2026-14161

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-3546

The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshotformbuildergetaccountdata function is registered as a wpajax AJAX handler accessible to all authenticated users. The function lacks any capability che...

CVE-2026-2720

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2026-26842

The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the hrp-fetch-employees AJAX action in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-4219

A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown functionality of the file com/index/event/BuildConfig.java of the component ae.index.apgcs. Executing a manipulation of the argument...

Server-side Request Forgery (SSRF)

Overview Azure.Mcp is an All Azure MCP tools in a single server. The Azure MCP Server implements the MCP specification to create a seamless connection between AI agents and Azure services. Azure MCP Server can be used alone or with the GitHub Copilot for Azure extension in VS Code. Affected...

EUVD-2026-10134

The Infomaniak Connect for OpenID plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'endpointlogin' parameter of the infomaniakconnectgenericauthurl shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-1073

The Purchase Button For Affiliate Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing nonce validation on the settings page form handler in inc/purchase-btn-options-page.php. This makes it possible for...

CVE-2026-1073 Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update

The Purchase Button For Affiliate Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing nonce validation on the settings page form handler in inc/purchase-btn-options-page.php. This makes it possible for...

CVE-2025-14353

The ZIP Code Based Content Protection plugin for WordPress is vulnerable to SQL Injection in all versions up to 1.0.2 via the 'zipcode' parameter. The issue arises from insufficient escaping of the user-supplied parameter and a lack of proper preparation in the existing SQL query, enabling unauth...