Exploit for CVE-2026-66917

IDOR + Stored XSS via Broken Object-Level Authorization in Joo...

CVE-2026-13598

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover...

CVE-2026-78115: Improper Authorization

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edituseraccount.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. The attack may be...

CVE-2026-60084

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

CVE-2026-59808

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

EUVD-2026-64269

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

CVE-2026-60084 SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

CVE-2026-60084 SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

CVE-2026-60083 SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected by the HTTP API. Authenticated administrators can read plaintext publish-mode passwords from data/.siyuan/publishAccess.json and access othe...

CVE-2026-59808

AVideo (through commit 9c39d8c8) is affected by an authentication bypass vulnerability. The root cause lies in deduplicateByEncoderQueueId(), which returns video_id_hash credentials for any video by encoder_queue_id without ownership verification , and useVideoHashOrLogin(), which converts this h...

CVE-2026-59808 AVideo Authentication Bypass via Unkeyed Video Hash Disclosure

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

CVE-2026-78003

The Mailgun for WordPress plugin for WordPress (versions up to and including 2.2.0 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) via path traversal. The root cause is insufficient input validation in the add_list() function, which accepts user-controlled array keys from...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-77001 Social Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication Bypass

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user,...

CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin, in versions prior to 1.8.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The flaw exists because the plugin fails to properly sanitise and escape a custom post type setting before rendering it within an HTML attribute on...

CVE-2026-76789: Improper Neutralization of Input During Web Page Generation

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be execute...

CVE-2026-16260: Improper Neutralization of Input During Web Page Generation

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-60084: Improper Limitation of a Pathname to a Restricted Directory

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...