CVE-2026-39433: Missing Authorization

Subscriber Arbitrary Content Deletion in WPAMS 49.5.3 versions...

CVE-2026-54804: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in Melhor Envio = 2.16.3 versions...

CVE-2026-46964: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

CVE-2025-69137: Missing Authorization

Subscriber Broken Access Control in Genemy = 1.6.6 versions...

CVE-2026-40723: Missing Authorization

Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...

CVE-2025-60218: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...

CVE-2026-46965: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

CVE-2026-7850: Undefined Security Weakness

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks...

CVE-2026-45436: Missing Authorization

Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...

CVE-2026-46966: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2026-46963: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

CVE-2026-39546: Incorrect Privilege Assignment

Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...

CVE-2026-48967: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...

CVE-2026-49133: Improper Limitation of a Pathname to a Restricted Directory

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile with an empty folder...

CVE-2026-54805: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...

CVE-2026-40748: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities

ReDoS attacks constitute a critical class of resource-exhaustion vulnerabilities. In such attacks, adversaries exploit the pathological worst-case execution behavior of regular expression regex engines to induce highly asymmetric computational workloads, ultimately exhausting system resources and...

CVE-2026-12115: Deserialization of Untrusted Data

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...

Microsoft Teams Android Arbitrary Command Execution

The vulnerability of Microsoft Teams’ corporate platform for Android is related to the lack of measures taken at the management level to secure data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

EUVD-2026-37177

In lwisdeviceexternaleventemit of lwisevent.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...