CVE-2026-28150

The Golo Framework WordPress plugin (versions before 1.7.5) contains an unauthenticated Local File Inclusion vulnerability. CVSS 3.1 scores it HIGH (8.1) with network attack vector, no privileges or user interaction required. Affected sites should upgrade to version 1.7.5 immediately. No in-the-w...

EUVD-2026-63329

Unauthenticated Local File Inclusion in Golo Framework 1.7.5 versions...

CVE-2025-15637

CVE-2025-15637 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress Shuffle theme , affecting versions 1.8 and earlier . The flaw allows a remote attacker with no prior access to include arbitrary local files, potentially leading to full compromise of confidentiality, i...

CVE-2025-15637 WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...

EUVD-2025-210754

Unauthenticated Local File Inclusion in Shuffle = 1.8 versions...

WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Tonda Core versions 2.6...

WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Tonda versions 2.6...

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...

WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Måne versions = 1.7...

WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Verdure Core versions = 1.2...

CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

CVE-2026-75963

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

EUVD-2026-63199

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

GHSA-74FJ-2J2H-C42Q vulnerabilities

Vulnerabilities for packages: arangodb...

PT-2026-78888

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme single event page template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrar...

CVE-2026-62668 Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTERVALIDATEURL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPTPROTOCO...

CVE-2026-62668

Grav API Plugin (RESTful API for Grav CMS) prior to 1.0.6 is vulnerable to SSRF via unrestricted cURL protocols in webhook dispatch. The WebhookController.php accepts webhook URLs with only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS...

CVE-2026-62668 Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTERVALIDATEURL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPTPROTOCO...