CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

EUVD-2026-83503

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574: Missing Authorization

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

WordPress Classified Listing plugin < 6.1.1 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Usama Arshad in WordPress Plugin Classified Listing versions 6.1.1...

CLEANSTART-2026-XV99350 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the kyverno package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CLEANSTART-2026-BY91066 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the dynatrace-operator package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CLEANSTART-2026-SH05010 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CVE-2026-75168: Improper Access Control

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

EUVD-2026-63432

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over...

CVE-2026-73356

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-73356 WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-73356

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-73356

The Breeze WordPress plugin (versions

PT-2026-77095

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-42164

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

PT-2026-73113

The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import zip function in versions up to, and including, 1.6.0. The handler is registered on both wp ajax action-import-zip and wp ajax nopriv action-import-zip...