EUVD-2026-51921

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewpgetsvgcontent' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensiti...

CVE-2026-13339

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewpgetsvgcontent' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensiti...

CVE-2026-13339: Improper Limitation of a Pathname to a Restricted Directory

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewpgetsvgcontent' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensiti...

CVE-2026-13339 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewpgetsvgcontent' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensiti...

CVE-2026-13339

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewpgetsvgcontent' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensiti...

CVE-2026-13339

The CVE-2026-13339 issue concerns the CubeWP Framework WordPress plugin, affected versions are all up to and including 1.1.30. Affected component: cubewp_get_svg_content function, which allows a Directory Traversal. Unauthenticated attackers can read arbitrary server files containing sensitive in...

CVE-2026-67332

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

CVE-2026-67290

FreeRDP before 3.29.0 contains a heap out-of-bounds read vulnerability in the TSMF FFmpeg decoder when parsing AVC1 MPEG2VIDEOINFO media types with insufficient ExtraData. Attackers can send malformed media format data from a server to trigger a crash by reading fixed offsets without validating...

CVE-2026-67332

Technical details (affected products/versions/mitigation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-67339

GuzzleHTTP/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers, allowing proxy credentials to be captured in origin logs during redirects or SOCKS proxy scenarios. This affects guzzlehttp/guzzle prior to 7.14.2 and can occur when...

CVE-2026-6453

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

CVE-2026-6453 CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

EUVD-2026-51792

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

CVE-2026-6453

The CVE-2026-6453 issue affects the CubeWP Framework WordPress plugin (all versions ≤ 1.1.30). The root cause is insufficient input sanitization in cubewp_remove_relation() where wp_unslash() is applied to the relation_id parameter and then interpolated directly into a raw SQL query without using...

CVE-2026-6453

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

CVE-2026-6453 CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

DOM-based XSS org.springframework:spring-webmvc Dependency in Jira Software Data Center

This High severity DOM-based XSS vulnerability was introduced in versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DOM-based XSS vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N allows an unauthenticated attacke...

DOM-based XSS org.springframework:spring-webmvc Dependency in Jira Service Management Data Center

This High severity DOM-based XSS vulnerability was introduced in versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DOM-based XSS vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N allows an unauthenticat...

DOM-based XSS org.springframework:spring-webmvc Dependency in Crowd Data Center

This High severity DOM-based XSS vulnerability was introduced in versions 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This DOM-based XSS vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N allows an unauthenticated attacker to execute...

DoS (Denial of Service) org.springframework:spring-webmvc Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows ...