CVE-2026-5581

The CVE-2026-5581 entry concerns the WordPress plugin Multi Uploader for Gravity Forms . It is vulnerable in all versions up to and including 1.1.8 due to missing capability checks in the function plupload_ajax_delete_file() , which is registered via wp_ajax_nopriv_gfmu_delete_file . The CSRF-pro...

EUVD-2026-53124

In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project...

EUVD-2026-53123

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

CVE-2026-49004

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

CVE-2026-49004 PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing...

CVE-2026-16993

CVE-2026-16993 affects the DHL Shipping Germany for WooCommerce WordPress plugin, versions before 4.0.1. The issue arises because the plugin stores shipping labels in a directory that relies solely on an Apache .htaccess for access control. On servers that do not honor .htaccess (e.g., nginx), un...

CVE-2026-16981

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-16746

Technical details about CVE-2026-16746 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2026-16940

CVE-2026-16940 concerns the Custom Fields WordPress plugin prior to 1.5.1. The issue is a path traversal vulnerability that does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (e.g., wp-config.php). This can lead to a...

CVE-2026-16968

The CVE describes a vulnerability in the GeoDirectory WordPress plugin (versions before 2.8.168) where a user-search handler does not enforce proper authorization. This allows any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, i...

CVE-2026-16602

CVE-2026-16602 affects the Passster WordPress plugin prior to version 4.3.6 . The issue arises because the plugin does not perform a post-status check when serving post content from an unauthenticated REST endpoint protected by a captcha provider, allowing unauthenticated users to disclose conten...

CVE-2026-16603

CVE-2026-16603 affects the Passster WordPress plugin prior to 4.3.6. The issue is that the plugin does not enforce category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts via the core REST AP...

CVE-2026-16604

The CVE-2026-16604 affects the Passster WordPress plugin prior to version 4.3.6. Affected behavior: unauthenticated users can access content that is supposed to be password-protected because protected block content is emitted in the public page response before password verification, via the conte...

CVE-2026-16561

The CVE covers Sunshine Photo Cart for WordPress, affected in versions before 3.6.12. The issue is missing access controls in an AJAX action, allowing unauthenticated users to retrieve comments for images in private or password-protected galleries. This exposes potentially sensitive gallery metad...

CVE-2026-68078 Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version...

CVE-2026-67554 Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Proton-Dotnet: through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes t...

EUVD-2026-53034

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

CVE-2026-5062

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

CVE-2026-5062

CVE-2026-5062 affects PrettyLinks (WordPress plugin) versions up to and including 3.6.20. The vulnerability is an SQL injection via the 's' (search) parameter on the Pretty Links listing page, caused by insufficient escaping and lack of proper prepared statements in search_links_table(). It requi...

CVE-2026-15941

The CVE details a SQL injection in Relevanssi (WordPress plugin) versions up to 4.27.1 and Premium up to 2.30.2 via the Admin Search AJAX: an args parameter is parsed into WP_Query and used to build taxonomy restrictions, with taxonomy value sanitized as text but not parameterized for SQL before ...