CVE-2026-17599 Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

CVE-2026-17601

A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment...

CVE-2026-48093 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed

The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting XSS through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the pa...

CVE-2026-48093

CVE-2026-48093 affects the Code Embed WordPress plugin (pre-2.6.1). The vulnerability is a stored XSS in the external URL embed feature used in post content: the code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the page without ou...

EUVD-2026-54488

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-19264

Postiz is an open-source social media scheduling tool affected by CVE-2026-19264. The vulnerability arises in the route that serves locally stored media, which concatenates URL path segments into the upload directory and streams files without proper path normalization or directory confinement. UR...

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-66494

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript...

CVE-2026-66494

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript...

CVE-2026-16030

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including...

EUVD-2026-54382

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

EUVD-2026-54326

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-54229

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

EUVD-2026-54210

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-62873

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

📄 WordPress WP2Shell SQL Injection / Remote Code Execution

This Metasploit module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137...

Python Library Django 5.2.x < 5.2.17 / 6.0.x < 6.0.8 Multiple Vulnerabilities

The detected version of the Django Python package is 5.2.x prior to 5.2.17 or 6.0.x prior to 6.0.8. It is, therefore, affected by multiple vulnerabilities, including: - GeoDjango spatial lookups pass untrusted input to the GDALRaster constructor, allowing an attacker to write arbitrary files via ...

CVE-2026-62873 Microsoft 365 Admin Center Elevation of Privilege Vulnerability

...

CVE-2026-62873

Microsoft 365 Admin Center is affected by CVE-2026-62873 due to improper verification of cryptographic signatures, enabling elevated privileges over a network for an unauthorized attacker. The vulnerability details provided across sources (NVD, ENISA EUVD, CVE listing, and MSRC) confirm the issue...

CVE-2026-62873

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...