CVE-2026-66690 WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...

CVE-2026-16268

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts...

Important: Red Hat Security Advisory: RHTAS 1.4.3 - Tech Preview Release Of the Model Validation Operator

The Tech Preview release of the RHTAS Model Validation Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Model Validation Operator can be used with OpenShift Container Platform 4.16, 4.17,...

WordPress WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce plugin <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation vulnerability

Authenticated Shop Manager+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPify Woo Czech versions = 5.4.16...

WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin GiveWP versions = 4.16.5...

CVE-2026-14318 GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

PT-2026-66373

Name of the Vulnerable Software and Affected Versions Eventin versions prior to 4.1.16 Description An authorization flaw allows unauthenticated users to create orders and specify an attacker-supplied order status. This enables the bypass of payment processes by marking orders as paid without...

CVE-2026-65441

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.3 versions...

WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin GiveWP versions = 4.16.3...

PT-2026-65320

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.4 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations Update GiveWP to version 4.16...

CVE-2026-12504

Improper Authentication CWE-287 in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an /etc/passwd entry with an emp...

CVE-2026-55728

Stack-based Buffer Overflow CWE-121 in /usr/bin/ltsudo cmdipaddrconflict in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly lo...

EUVD-2026-48590

Improper Privilege Management CWE-269 in /usr/bin/ltsudo in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a superadmin-group attacker to reset the password of any LARM user including the larmapp service account via the set-passwd...

CVE-2026-65464

Unauthenticated Cross Site Request Forgery CSRF in GiveWP = 4.16.3 versions...

PT-2026-63886

Unauthenticated Cross Site Request Forgery CSRF in GiveWP = 4.16.3 versions...

EUVD-2026-44687

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses...

EUVD-2026-44689

Cloudreve: OAuth access tokens bypass scope enforcement due to missing clientid claim...

CVE-2026-13352 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowedmimetypes function. This is due to the unconditional...

Important: Red Hat Security Advisory: RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release

The 1.3.6 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

CVE-2026-54560

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth clientid claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session...