EUVD-2026-62389

Unauthenticated SQL Injection in Nikstore Core = 1.5 versions...

CVE-2026-73386 WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

EUVD-2026-62387

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...

CVE-2026-73386

The WordPress plugin "Track Geolocation Of Users Using Contact Form 7" through version 3.0.2 exposes sensitive data to unauthenticated users over the network (CVSS 7.5 HIGH, C:H/I:N/A:N). No exploitation status or remediation details are provided in the documents. Monitor for plugin updates. Patc...

CVE-2026-73384 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

EUVD-2026-62385

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...

CVE-2026-73384

Pay with Contact Form 7 is a WordPress plugin affected by an unauthenticated sensitive data exposure vulnerability in versions

mysql: X Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

SummaryGlances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

PYSEC-2026-3667 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Summary Glances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead ...

Reverse-Lookup Service Exposed Millions of Photos of People’s Faces

The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed...

Vulnerabilities found in Oracle Financial Services

Oracle has identified vulnerabilities in various Financial Services Enterprise modules. These vulnerabilities exist in third-party products such as Apache Kafka, Log4j, and the Spring Framework. Updates have been released by the developers for these products. These updates are now integrated into...

BIT-ELK-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

MINI-8V39-V7X2-9FH3

Bulletin has no description...

CVE-2026-18231

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plug...

CVE-2026-16616

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-19417

KiviCare WordPress plugin before 4.5.4 serves media files without verifying the requesting user's entitlement, enabling authenticated patient-level users to download any media library file including other patients' medical reports via an IDOR vulnerability; upgrade to 4.5.4. No active exploitatio...

EUVD-2026-62288

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

EUVD-2026-62283

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address...

PT-2026-78387

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description An issue exists in the glossary create and update endpoints where an escaped string is truncated before being embedded in a SQL literal. Authenticated users with permissions to add or edit the...