EUVD-2026-82382

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

CVE-2026-92757

MongoDB Entity Framework Core Provider is affected by a vulnerability where placing a database name in the connection string may inadvertently disable field-level encryption , leaving sensitive data unprotected. The root cause is a malformed connection string interpretation by the provider. The i...

Malformed connection string may disable field level encryption

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

GHSA-JH4V-GFQJ-7RHX RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Vulnerability In AMQConnection.java line 435-436, after Connection.Tune negotiation, the frame-max limit is set via: java frameHandler.setFrameMax Math.minthis.maxInboundMessageBodySize, frameMax; When frameMax = 0 meaning "unlimited" per AMQP spec, Math.min67108864, 0 = 0. This value is then...

CVE-2026-74000

CVE-2026-74000 affects the WordPress Simple Membership plugin in versions ≤ 4.8.2 . The vulnerability is a Broken Access Control flaw discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 5.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N , indicating a network-exploitable...

EUVD-2026-81498

Contributor Cross Site Scripting XSS in JetSearch = 3.6.3 versions...

CVE-2026-66576

CVE-2026-66576 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the JetBlocks For Elementor WordPress plugin, affecting versions 1.5.2 and earlier . The flaw was discovered by nh4tvd (reported via Patchstack). The vulnerability carries a CVSS 3.1 base score of 6.5 (MEDIUM) with ...

EUVD-2026-81497

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

EUVD-2026-81354

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

EUVD-2026-81316

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86311 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-86788: Improper Neutralization of Input During Web Page Generation

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

CVE-2026-91019: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

CVE-2026-92757: Missing Encryption of Sensitive Data

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption...