CVE-2026-11767

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in...

CVE-2026-13439

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-64190

A flaw was found in the Linux kernel's team driver. A local attacker with CAPNETADMIN capabilities could exploit a race condition during a team device mode change. This occurs when the teamchangemode function clears internal operation pointers before safely restoring them, while the teamxmit...

CVE-2026-6952

The CVE affects Zyxel AX7501-B1 firmware up to version 5.17(ABPC.7.2)C0, where a post-authentication command injection in the LogServer component of the syslog module is possible. An authenticated administrator can execute OS commands on the device, per the description. CVSS v3.1 metrics indicate...

Exploit for CVE-2026-13156

CVE-2026-13156 — MailerSend Official SMTP Integration About...

CVE-2026-16449: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/OrderItem.desc of the file /api/system/sys/dept/page of the component com.zs.sys.dept.controller.SysDeptController. This manipulation of the...

📄 WordPress MainWP Child 5.3.3 Unauthenticated Administrator Session Takeover

WordPress MainWP Child plugin version 5.3.3 contains an unauthenticated administrator session takeover vulnerability through Rogue Site Registration. A remote attacker can obtain an authenticated administrator session and take control of the affected site. This proof of concept exploit demonstrat...

📄 WordPress Hippoo 1.9.5 Unauthenticated Admin Account Takeover

WordPress Hippoo plugin version 1.9.5 contains an unauthenticated admin account takeover vulnerability through REST. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3...

📄 WordPress Invoice Creator 1.0.0 Unauthenticated Account Takeover

WordPress Invoice Creator plugin version 1.0.0 contains an unauthenticated account takeover vulnerability through Arbitrary User Email Change. A remote attacker can take over another user account. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin...

📄 WordPress Booking Activities 1.16.43 Authentication Bypass

WordPress Booking Activities plugin version 1.16.43 contains an authentication bypass vulnerability through Login Without Password. A remote attacker can authenticate without valid credentials and access protected functionality. This proof of concept exploit demonstrates the vulnerable request fl...

📄 WordPress Registration Password 1.0.1 Unauthenticated Administrator Account Takeover

WordPress Registration Password plugin version 1.0.1 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the...

📄 WordPress Login Customizer 2.5.3 Unauthenticated Account Takeover

WordPress Login Customizer plugin version 2.5.3 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affect...

CVE-2026-61263: Improper Access Control

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite component: Scripting Admin. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful...

CVE-2026-60400: Improper Access Control

Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate...

CVE-2026-60397: Improper Resource Shutdown or Release

Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

CVE-2026-60395: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate. Successf...

CVE-2026-60394: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this...

CVE-2026-47689: Improper Neutralization of Input During Web Page Generation

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the buildRow method in fogpage.class.php substitutes data values into HTML table cell templates using strreplace without any HTML escaping. An unauthenticated...

CVE-2026-16451: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This impacts an unknown function of the file /api/system/file/upload of the component com.zs.file.controller.SysFileController. Performing a manipulation of the argument File results in...

CVE-2026-65049: Incorrect Authorization

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration...