CVE-2026-2487: Improper Neutralization of Input During Web Page Generation

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2026-73100

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.30.0 Description This issue allows for privilege escalation due to improper authorization checks in the ActionUser::conditions logic function. The authorization check current user can'edit user'...

PT-2026-73088

Name of the Vulnerable Software and Affected Versions Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution versions prior to 5.4.13 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows...

PT-2026-73107

Name of the Vulnerable Software and Affected Versions Toocheke Companion versions prior to 2.11 Description The Toocheke Companion plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the toocheke series bg color save function fails to properly sanitize input fro...

PT-2026-73081

Name of the Vulnerable Software and Affected Versions Gravity Booster – Styles & Layouts for Gravity Forms versions prior to 5.27 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the admin settings. Authenticated attackers with...

PT-2026-73143

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...

CVE-2026-73046 SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...

CVE-2026-73046

SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code Conf.AccessAuthCode as the Basic Auth password but never consults the...

CVE-2026-73046

Technical details for CVE-2026-73046 are not publicly provided in the supplied documents; monitor for updates from vendors and advisories.

CVE-2026-19904

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

CVE-2026-19904 SourceCodester Online Book Store System System Settings index.php site_settings cross site scripting

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

Exploit for SQL Injection in Metabase

CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection...

UBUNTU-CVE-2026-72131

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...

CVE-2026-72049

In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154NL family ops table builds the LLSEC dump entries LLSECLISTKEY, LLSECLISTDEV, LLSECLISTDEVKEY, LLSECLISTSECLEVEL with...

CVE-2026-18216

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without...

CVE-2026-18216

The Backup Migration WordPress plugin (versions before 2.1.7 ) contains an improper authentication vulnerability. The root cause is a failure to properly restrict a post-restore automatic login mechanism . This allows a user with administrator privileges on one site within a multisite network to ...

EUVD-2026-58889

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...

CVE-2026-72131 nvme-apple: Prevent shared tags across queues on Apple A11

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...

CVE-2026-72051 net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink

In the Linux kernel, the following vulnerability has been resolved: net: ip6tunnel: require CAPNETADMIN in the device netns for changelink ip6tnlchangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...

CVE-2026-16145

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...