CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin (all versions up to and including 4.13.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping when handling Facebook Comment Messages via v-html in...

EUVD-2026-91253

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output...

CVE-2026-100182 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100182 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-102565

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661 WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

EUVD-2026-91208

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-102565 BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-91203

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookingserviceqty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

gvfs security update

An update is available for gvfs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GVFS is the GNOME Desktop Virtual File System layer that allows users to easily...

RLSA-2026:74370 Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

Exploit for CVE-2026-14378

CVE-2026-14378: Unauthenticated Authentication Bypass in WordP...

SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition

SAP NetWeaver AS JAVA LM Configuration Wizard, versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

PT-2026-104064

Name of the Vulnerable Software and Affected Versions itsourcecode Pet Shop Management System version 1.0 Description A SQL injection issue exists in the admin reject completed.php file. This occurs when the ID argument is manipulated, allowing a remote attacker to execute unauthorized database...

CVE-2026-104467: Missing Authorization

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - An authentication bypass vulnerability exists in the API session-based authentication management of Cisco Catalyst SD-WAN Manager due to improper handling of URI encoding hex encoding in HTTP...

Rocky Linux 10.2 [CIQ] Security Update: gvfs / gvfs-client / gvfs-client-debuginfo / gvfs-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_73998)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202673998 advisory. gvfs: SFTP: heap-based buffer overflow in readreply CVE-2026-84268 gvfs: gvfs-admin socket ownership race permits local root CVE-2026-88924 Tenable has...

CVE-2026-104625: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...