EUVD-2026-53117

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

PT-2026-67970

Name of the Vulnerable Software and Affected Versions OTP Login With Phone Number, OTP Verification WordPress plugin versions prior to 1.8.71 Description An issue exists where the plugin fails to limit the number of OTP verification attempts and does not invalidate a one-time login code after an...

CVE-2026-15210: Improper Authentication

The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...

PT-2026-68033

Name of the Vulnerable Software and Affected Versions WPFormify – Stripe Payments with Form and Checkout versions prior to 1.1.2 Description Unauthenticated attackers can modify or delete Stripe payment credentials. This occurs because the wpf stripe callback success and wpf stripe disconnect...

CVE-2026-6627: Missing Authorization

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

PT-2026-68113

Name of the Vulnerable Software and Affected Versions Documenso affected versions not specified Description In the live document-signing UI, the sign-field-with-token.ts handler allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any not-yet-signed recipient in th...

CVE-2026-71247: Incorrect Authorization

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...

CVE-2026-11421: Improper Neutralization of Special Elements used in an SQL Command

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2026-59935 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2026-59935 Source advisory: OSV:PYSEC-2026-361...

PT-2026-67840

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.6 Description An authentication bypass exists in the AJAX dispatcher. Unauthenticated attackers can access admin-gated endpoints by providing any X-Requested-With header and requesting a base64-encoded path th...

CVE-2026-70552: Missing Authentication for Critical Function

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any -ajax.php file in the codebase...

CVE-2026-51190

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

CVE-2026-62416: Initialization of a Resource with an Insecure Default

Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and uploa...

CVE-2026-41452: Missing Authentication for Critical Function

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...

enot-autodl (>=3.3.1, <=3.4.3), farm-haystack (1.5.0) +6 more potentially affected by CVE-2026-9856 via transformers (4.19.2)

transformers PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - enot-autodl =3.3.1, =0.7.2, =0.2.0, =2.1.0, =2.1.2 - textdiversity 0.0.1 Source cves: CVE-2026-9856 Source advisory:...

CVE-2026-15950: Improper Neutralization of Input During Web Page Generation

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization an...

CVE-2026-13725: Improper Neutralization of Input During Web Page Generation

The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...

CVE-2026-14561: Improper Authentication

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-16614: Improper Neutralization of Special Elements used in an SQL Command

The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

chat-with-mlx (>=0.1.0, <=0.1.11), raga-llm-eval (>=2.0.0a12, <=2.0.0b27) +1 more potentially affected by CVE-2026-68770 via sentence-transformers (2.4.0)

sentence-transformers PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - chat-with-mlx =0.1.0, =2.0.0a12, =2.0.0b27 - ragcar 0.1.0 Source cves: CVE-2026-68770 Source advisory:...