CVE-2026-66447

Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...

CVE-2026-66440

Unauthenticated Cross Site Scripting XSS in WPIDE – File Manager & Code Editor = 3.5.7 versions...

CVE-2026-65565

Unauthenticated Cross Site Scripting XSS in Survey Maker = 5.2.3.3 versions...

EUVD-2026-53985

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

EUVD-2026-53974

Unauthenticated Cross Site Scripting XSS in Super Socializer = 7.14.5 versions...

EUVD-2026-53972

Unauthenticated Broken Authentication in Super Socializer = 7.14.5 versions...

CVE-2026-65542 WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Super Socializer = 7.14.5 versions...

CVE-2026-65542

CVE-2026-65542 concerns the WordPress WordPress Super Socializer plugin, affected versions

CVE-2026-65515 WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.35.0 versions...

CVE-2026-61964 WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...

WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dzeusking in WordPress Plugin WP Job Portal versions = 2.5.6...

CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps

Coinspect has identified CryptoJS.lib.WordArray.random as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect'...

CVE-2026-16734

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...

EUVD-2026-53678

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

CVE-2026-19027

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 prior to 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

EulerOS 2.0 SP13 : krb5 (EulerOS-SA-2026-2972)

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a system with a NegoEx...

CVE-2026-15147: Insufficient Verification of Data Authenticity

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

PT-2026-68650

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

AlmaLinux 10 : java-25-openjdk (ALSA-2026:42899)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:42899 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance...

EulerOS 2.0 SP15 : krb5 (EulerOS-SA-2026-2931)

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gssacceptseccontext...