CVE-2026-14197

The CVE-2026-14197 entry concerns the Fluent Support WordPress plugin (versions before 2.3.1). The documented vulnerability is an IDOR-style flaw caused by a missing per-ticket access check when reassigning a ticket’s customer, enabling a restricted agent to change the assigned customer on any ti...

CVE-2026-17567

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

CVE-2026-17567

The CVE-2026-17567 entry affects the WordPress plugin Fluent Forms

EUVD-2026-51517

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

CVE-2026-17567 Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

CLEANSTART-2026-BC71667 Security fixes in fluent-operator-fips 3.8.0-r0

Package fluent-operator-fips version 3.8.0-r0 fixes 1 vulnerabilities: CVE-2026-39824...

CLEANSTART-2026-AY28524 Security fixes in fluent-operator-fips 3.2.0-r6

Package fluent-operator-fips version 3.2.0-r6 fixes 4 vulnerabilities: CVE-2025-68121, CVE-2026-25679, CVE-2025-61726, CVE-2025-61728...

CLEANSTART-2026-LB48221 Security fixes in fluent-operator-fips 3.2.0-r7

Package fluent-operator-fips version 3.2.0-r7 fixes 10 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-33810, CVE-2026-27144, CVE-2026-32280...

CLEANSTART-2026-OZ37229 Security fixes in fluent-operator-fips 3.5.0-r0

Package fluent-operator-fips version 3.5.0-r0 fixes 2 vulnerabilities: ghsa-9h8m-3fm2-qjrq, CVE-2026-24051...

CLEANSTART-2026-ID80662 Security fixes in fluent-operator-fips 3.7.0.-r1

Package fluent-operator-fips version 3.7.0.-r1 fixes 5 vulnerabilities: CVE-2026-33186, CVE-2026-27139, CVE-2026-27142, CVE-2026-25679, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-SZ09294 Security fixes in fluent-operator-fips 3.7.0-r2

Package fluent-operator-fips version 3.7.0-r2 fixes 6 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-27140, CVE-2026-32283...

CLEANSTART-2026-BN98240 Security fixes in fluent-operator-fips 3.3.0-r7

Package fluent-operator-fips version 3.3.0-r7 fixes 4 vulnerabilities: CVE-2026-27139, CVE-2025-61730, CVE-2026-27142, CVE-2025-61728...

CLEANSTART-2026-AA56293 Security fixes in fluent-bit-plugin-loki 3.6.5-r0

Package fluent-bit-plugin-loki version 3.6.5-r0 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-24051, CVE-2026-25679, CVE-2026-33186...

CLEANSTART-2026-RB80888 Security fixes in fluent-operator-fips 3.6.0-r5

Package fluent-operator-fips version 3.6.0-r5 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811...

CLEANSTART-2026-SP66838 Security fixes in fluent-operator 3.6.0-r0

Package fluent-operator version 3.6.0-r0 fixes 3 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-25679...

CLEANSTART-2026-UC35253 Security fixes in fluent-operator-fips 3.7.0-r3

Package fluent-operator-fips version 3.7.0-r3 fixes 11 vulnerabilities: CVE-2026-39836, CVE-2026-33811, CVE-2026-33814, CVE-2026-42499, CVE-2026-39820...

CVE-2026-11881

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

CVE-2026-11881 Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

CVE-2026-11881

CVE-2026-11881 affects the Fluent Forms WordPress plugin prior to 6.2.6. The vulnerability arises because a form field configuration setting is not sanitized/escaped before being output inside an inline script during form rendering, enabling Stored XSS. The issue can be exploited by a user with C...

EUVD-2026-51005

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...