CVE-2026-39433: Missing Authorization

Subscriber Arbitrary Content Deletion in WPAMS 49.5.3 versions...

CVE-2026-54804: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in Melhor Envio = 2.16.3 versions...

CVE-2025-69137: Missing Authorization

Subscriber Broken Access Control in Genemy = 1.6.6 versions...

CVE-2026-40723: Missing Authorization

Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...

CVE-2025-60218: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...

CVE-2026-40749: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

CVE-2026-46963: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

CVE-2026-49133: Improper Limitation of a Pathname to a Restricted Directory

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile with an empty folder...

CVE-2026-54805: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...

CVE-2026-40748: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

PUFFERDOS: Efficient and Effective Attack String Generation for Regular Expression Denial of Service Vulnerabilities

ReDoS attacks constitute a critical class of resource-exhaustion vulnerabilities. In such attacks, adversaries exploit the pathological worst-case execution behavior of regular expression regex engines to induce highly asymmetric computational workloads, ultimately exhausting system resources and...

CVE-2026-12115: Deserialization of Untrusted Data

The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-7850: Undefined Security Weakness

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks...

CVE-2026-39546: Incorrect Privilege Assignment

Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...

CVE-2026-46964: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

CVE-2026-46965: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

CVE-2026-46966: Undefined Security Weakness

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

EUVD-2026-37177

In lwisdeviceexternaleventemit of lwisevent.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0143

A use after free memory corruption vulnerability exists in the lwis_device_external_event_emit function within lwis_event.c of the LWIS component in Google Android . An attacker with System execution privileges could exploit this flaw to achieve a local escalation of privilege . No specific explo...

CVE-2026-0138

In lwisiobufferwrite of lwisiobuffer.c, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...