CVE-2026-65689 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65605

SiYuan prior to v3.7.2 is vulnerable to a stored XSS in the Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, with EscapeHTML applied only when HasUnclosedHtmlTag is true; balanced self-closing tags like can bypass this...

EUVD-2026-48241

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

EUVD-2026-48133

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...

EUVD-2026-48216

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-61947

The CVE covers WordPress Form Vibes – Database Manager for Forms plugin (

EUVD-2026-48205

Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...

EUVD-2026-48201

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.3 versions...

CVE-2026-59555

CVE-2026-59555 affects WordPress: Participants Database plugin version

EUVD-2026-48191

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

CVE-2026-59525

The CVE covers the WordPress plugin Participants Database (affected version:

CVE-2026-27423

Technical details (affected versions, root cause, impact, patches) are not publicly provided in the supplied documents. Monitor for updates.

EUVD-2026-48161

Subscriber Broken Access Control in Participants Database = 2.7.8.4 versions...

EUVD-2026-48144

Contributor SQL Injection in Create by Mediavine = 2.5.3 versions...

CVE-2026-24552

CVE-2026-24552 concerns the WordPress plugin “Create by Mediavine” (versions

CVE-2026-65431

Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions...

CVE-2026-64876

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates...

EUVD-2026-47905

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

CVE-2026-13119 Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtecrecordsedit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $POST'standard' and uses the JS...