CVE-2026-65689

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65689

Bold Reports Standalone Report Designer before 14.1.12 is affected by a path traversal vulnerability in the database download feature that allows unauthenticated attackers to read arbitrary files on the server filesystem, including authentication credentials, potentially giving full unauthorized ...

CVE-2026-65689 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via Database Download

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65605

SiYuan prior to v3.7.2 is vulnerable to a stored XSS in the Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, with EscapeHTML applied only when HasUnclosedHtmlTag is true; balanced self-closing tags like can bypass this...

EUVD-2026-48241

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

EUVD-2026-48133

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...

EUVD-2026-48216

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-61947

The CVE covers WordPress Form Vibes – Database Manager for Forms plugin (

EUVD-2026-48205

Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...

EUVD-2026-48201

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.3 versions...

CVE-2026-59555

CVE-2026-59555 affects WordPress: Participants Database plugin version

EUVD-2026-48191

Unauthenticated SQL Injection in Participants Database = 2.7.8.3 versions...

CVE-2026-59525

The CVE covers the WordPress plugin Participants Database (affected version:

CVE-2026-27423

Technical details (affected versions, root cause, impact, patches) are not publicly provided in the supplied documents. Monitor for updates.

EUVD-2026-48161

Subscriber Broken Access Control in Participants Database = 2.7.8.4 versions...

CVE-2026-24552

CVE-2026-24552 concerns the WordPress plugin “Create by Mediavine” (versions

EUVD-2026-48144

Contributor SQL Injection in Create by Mediavine = 2.5.3 versions...

CVE-2026-65431

Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions...

CVE-2026-64876

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates...