CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

WordPress WP Ultimate CSV Importer plugin < 9.0 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Jaan Buerms in WordPress Plugin WP Ultimate CSV Importer versions 9.0...

CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

CVE-2026-76547 Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by defaul...

WordPress User Profile Builder plugin < 4.0.1 - Admin+ PHP Object Injection vulnerability

Admin+ PHP Object Injection vulnerability discovered by Vivien LEBAS in WordPress Plugin Profile Builder versions 4.0.1...

EUVD-2026-66394

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

PT-2026-83417

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description The plugin fails to perform a capability check on an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to delete arbitrary...

PT-2026-83413

Name of the Vulnerable Software and Affected Versions WP Ultimate CSV Importer versions prior to 9.0 Description Insufficient sanitization and escaping of imported field values before their use in a SQL statement allows high privilege users, such as administrators, to perform SQL injection attack...

CVE-2026-80488: Improper Neutralization of Special Elements used in an SQL Command

The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...

CVE-2026-81346: Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

CVE-2026-55779

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

GHSA-J5G3-42WP-GQM3 Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

EUVD-2026-68015

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

EUVD-2026-42286

SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets...

CVE-2026-55485

creationtimestamp| type| source ---|---|--- 2026-08-28 20:35:29+00:00| published-proof-of-concept| https://github.com/piccolo-orm/piccoloadmin/security/advisories/GHSA-2gh4-jmwq-rr8w 2026-08-30 12:02:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mucduenvgk2z...

EUVD-2026-42297

Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances...

Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances

Summary Portainer supports restoring an instance from a backup archive via the /api/restore endpoint. This endpoint is intentionally unauthenticated to allow restoring before the first admin account is created, and remains accessible for the five-minute initialization window that opens each time...