CVE-2026-84190 LibreNMS before 26.5.0 Remote Code Execution via AboutController

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shellexec without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

OpenEMR < 7.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2948 info: name: OpenEMR 7.0.1 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...

CVE-2026-80607

A flaw was found in the Linux kernel's tracing/probes component. A local user could trigger a kernel warning WARNONONCE by adding a kprobe event based on a raw address with a BTF BPF Type Format parameter. This could lead to minor information disclosure through kernel log messages...

CVE-2026-80717

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted SCTP INIT message containing a malformed Adaptation Layer Indication parameter. The vulnerability causes the kernel to read beyond t...

CVE-2024-58379

A flaw was found in Nodemailer. A remote attacker can exploit a regular expression denial of service ReDoS vulnerability by sending specially crafted emails containing malicious data URLs or embedded attachments. This can cause the email parsing process to hang, leading to a denial of service for...

CVE-2026-19914

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-15101

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

wBlock v3.0.0

wBlock The end of Safari ad-blocking B.S. A Safari content blocker for macOS, iOS, iPadOS, and visionOS. 750,000 rules across 5 extensions, Protocol Buffer storage, LZ4 compression, and iCloud sync. !NOTE Looking for a detailed comparison? Check out my comparison guide to see how wBlock stacks up...

CVE-2026-15101 WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-69000

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-15101 WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-15101

The WPBakery Page Builder plugin for WordPress (versions up to and including 8.7.4 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability via the 'data' parameter . The root cause is a sanitization bypass: the wp_kses_post filter applied on save fails to strip the payload because the ...

EUVD-2026-68997

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-19914

Welcart e-Commerce (WordPress plugin) has a Stored Cross-Site Scripting vulnerability via the custom_order parameter , affecting all versions up to and including 2.12.1 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can inject arbitrary scripts...

CVE-2026-19914 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

CVE-2026-19914 Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customorder' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

WordPress WPBakery Page Builder plugin <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'data' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin WPBakery Page Builder versions = 8.7.4...

WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'customorder' Parameter vulnerability discovered by Afifudin Maarif in WordPress Plugin Welcart e-Commerce versions = 2.12.1...