EUVD-2026-100775

The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the file scope function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script,...

CVE-2026-110002

The Snazzy Social Media Feed plugin for WordPress (versions up to and including 2.5 ) is vulnerable to Arbitrary File Upload via the pluginURL parameter. The root cause is a standalone save-to-cache.php script that lacks WordPress bootstrap, authentication, capability, and nonce checks. Furthermo...

CVE-2026-93388

The Printcart Store PCDesigner / NB Designer plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesignercopyimagefromurl AJAX action is registered for logged-out callers wpajaxnopriv, and...

CVE-2026-92097

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...

CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

Alcatel-Lucent OmniPCX - Remote Command Execution

The OmniPCX web interface has a script "masterCGI" with a remote command execution vulnerability via the "user" parameter. id: CVE-2007-3010 info: name: Alcatel-Lucent OmniPCX - Remote Command Execution author: king-alexander severity: critical description: | The OmniPCX web interface has a scrip...

EUVD-2026-100770

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...

EUVD-2026-100766

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

CVE-2026-107652

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 1.4.1 . The root cause is that the plugin stores arbitrary submission fields in its db7_forms row. The process_bulk_action() delete handler matches any store...

CVE-2026-107652 Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7forms row and the processbulkaction delete handler then matchin...

CVE-2026-93388 Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url

The Printcart Store PCDesigner / NB Designer plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesignercopyimagefromurl AJAX action is registered for logged-out callers wpajaxnopriv, and...

CVE-2026-93388

The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in versions up to and including 2.9.1 . The vulnerability exists because the nbdesigner_copy_image_from_url AJAX action is registered for l...

EUVD-2026-100765

The Printcart Store PCDesigner / NB Designer plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesignercopyimagefromurl AJAX action is registered for logged-out callers wpajaxnopriv, and...

CLEANSTART-2026-OF55498 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Security vulnerability affects the wave package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...

EUVD-2026-100644

Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

EUVD-2026-100714

CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended...

CVE-2026-92817

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these...

PT-2026-113833

🚨 CVE-2026-101981 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message. 🎖@cveNotify...

CVE-2026-110690: Relative Path Traversal

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...

PT-2026-113963

Name of the Vulnerable Software and Affected Versions Appium versions prior to 7.2.6 Description ZIP extraction in @appium/support allows an archive entry to create a symbolic link to a location outside the extraction directory. A subsequent regular-file entry can then resolve through this link...