CVE-2026-12409

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...

EUVD-2026-44858

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...

CVE-2026-12409 Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...

CVE-2026-12409

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...

CVE-2026-12409 Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...

CVE-2026-12409

Technical details about CVE-2026-12409 are not publicly available in the provided documents. No connected sources with affected products, versions, impact, or fixes are present. Monitor for updates from official feeds.

PT-2026-60447

The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection...

CVE-2026-58078: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an unauthenticated SQL injection...

PT-2026-60423

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted pag...

image-builder security update

58-1.0.1 - v58 with osbuild/images v0.256.0 with OL support patches - Add Azure image type - Correct dnf-plugin-spacewalk package filters 56-1.0.1 - v56 with osbuild/images v0.254.0 with OL support patches - Add gce gcp image type to OL distro types 55-1.0.1 - v55 with osbuild/images v0.252.0 wit...

CVE-2026-15103: Improper Privilege Management

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the updatesettings REST callback failing to validate the groupid path...

CVE-2026-15008: Deserialization of Untrusted Data

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

CVE-2026-12978: Improper Neutralization of Input During Web Page Generation

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted pag...

CVE-2026-12869: Improper Neutralization of Input During Web Page Generation

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any editposts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...

CVE-2026-12409: Cross-Site Request Forgery (CSRF)

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpbadminajax function. Thi...

PT-2026-60397

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpb admin ajax function...

PT-2026-60443

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-67320

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An issue exists in the arcadedb-engine where trigger scripts can look up host classes in java.lang. via Java.type because the ScriptTriggerExecutor includes java.lang. in the allowed packages. An...

PT-2026-60420

The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action it allows any edit posts user, so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide,...

cockpit-image-builder security update

94.3-1.0.1 - Switch to old frotend Orabug: 38011073 Orabug: 37856296 Orabug: 37856375 - Replaced additional upstream url Orabug: 37856187 - Replaced upstream urls in documentation with oracle links Orabug: 37856187 94.3-1 - New upstream release 94.2-1 - New upstream release 94.1-1 - Resolve...