CVE-2026-19842

The WordPress SAML Single Sign On plugin (versions 4.8.85–5.4.6) fails to verify SAML response signatures before storing certificates, then exposes a one-click admin control that promotes any stored certificate to the trusted signing anchor. An unauthenticated attacker can submit a self-signed ce...

EUVD-2026-62287

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-14861

The User Verification by PickPlugins WordPress plugin (through 2.0.47) is vulnerable to an unauthenticated IDOR: the resend-verification-email endpoint fails to authorize the requesting user or bind the protecting token to that user, allowing attackers to reset email-verification status and lock ...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin (versions up to 3.2.36) fails to sanitize uploaded SVG files, allowing unauthenticated attackers to inject JavaScript that executes in an administrator's session when reviewing a submitted booking. CVSS 3.1 base score is 8.8 (HIGH)...

EUVD-2026-62264

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

PT-2026-78815

Name of the Vulnerable Software and Affected Versions Splunk Enterprise Security versions prior to 8.6.1 Description A user with the ess analyst role can modify User and Entity Behavior Analytics UEBA search macros. Because these macros are used by scheduled searches that execute with administrat...

PT-2026-78451

Name of the Vulnerable Software and Affected Versions J-BusinessDirectory versions prior to 6.2.3 Description Cross-site request forgery occurs because tokens are missing on several AJAX and state-changing tasks. Affected areas include contact and quote forms, the cart, bookmarks, uploads,...

PT-2026-78278

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System WordPress plugin versions prior to 3.2.37 Description The plugin fails to properly sanitize uploaded SVG files. This allows unauthenticated attackers to upload a file that bypasses the...

PT-2026-78786

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Administrator role can perform path traversal during the archive extraction process of the Universal Forwarder installer. This occurs because the credentials-package extraction...

UBUNTU-CVE-2026-23938

An authenticated administrator is able to crash Zabbix server or proxy...

UBUNTU-CVE-2026-23935

A Zabbix administrator is able to read out of bounds memory by utilizi...

CVE-2026-23935

A Zabbix administrator is able to read out of bounds memory by utilizi...

CVE-2026-54348

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-54347

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-55164

Netflix Lemur before 1.9.2 stores admin-set passwords in plaintext: lemur.users.service.update() assigns the password directly to User.password without calling hash_password(), and the model only registers a bcrypt before_insert listener, not before_update. A database or backup compromise exposes...

CVE-2026-61696

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-19501

CSV export functionality in Brainstorm Force SureForms version, = 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the...

CVE-2026-19501

CVE-2026-19501 is a CSV injection vulnerability in the Brainstorm Force SureForms WordPress plugin (versions ≤ 2.12.1). The CSV export functionality fails to sanitize spreadsheet formula characters in user-controlled form field names, allowing a remote attacker to inject formulas that execute on ...