CVE-2026-14872 Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

NPM: fast-uri vulnerable to host confusion via backslash authority introducer

NPM: fast-uri vulnerable to host confusion via backslash authority introducer vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.4...

NPM: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

NPM: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.18...

WordPress Element Pack Addons for Elementor plugin < 8.7.13 - Contributor+ DOM-Based Stored XSS vulnerability

Contributor+ DOM-Based Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Element Pack Elementor Addons versions 8.7.13...

CVE-2026-15248 Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

CVE-2026-14920

The AcyMailing SMTP Newsletter WordPress plugin (versions

WordPress Bit Form plugin < 3.1.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Bit Form versions 3.1.4...

CVE-2026-58039 affecting package nodejs for versions less than 24.18.1-1

CVE-2026-58039 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-7260 affecting package php for versions less than 8.3.33-1

CVE-2026-7260 affecting package php for versions less than 8.3.33-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48144 affecting package thrift for versions less than 0.24.0-1

CVE-2026-48144 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55971 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55971 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48525 affecting package python-jwt for versions less than 2.13.0-1

CVE-2026-48525 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-66053 affecting package thrift for versions less than 0.24.0-1

CVE-2026-66053 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55969 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1

CVE-2026-55970 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48526 affecting package python-jwt for versions less than 2.13.0-1

CVE-2026-48526 affecting package python-jwt for versions less than 2.13.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58043 affecting package nodejs for versions less than 24.18.1-1

CVE-2026-58043 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58040 affecting package nodejs for versions less than 24.18.1-1

CVE-2026-58040 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-41608 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41608 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...