CVE-2026-75327: Unrestricted Upload of File with Dangerous Type

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...

CVE-2026-75328

DocSys-master version 2.02.85 is vulnerable to an arbitrary file read vulnerability within the downloadDocEx interface located in src/com/DocSystem/controller/DocController.java. This flaw allows an attacker to access files on the system that should remain restricted. No information regarding a p...

PT-2026-82319

Name of the Vulnerable Software and Affected Versions DocSys-master version 2.02.85 Description An arbitrary file read issue exists in the 'downloadDocEx' interface located in src/com/DocSystem/controller/DocController.java. This allows an attacker to read files from the system that they should n...

Exploit for Improper Restriction of Excessive Authentication Attempts in Dani-Garcia Vaultwarden

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection...

CVE-2026-28153

Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

CVE-2026-28153 WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

CVE-2026-28153 WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

EUVD-2026-64792

Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

CVE-2026-28153

Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin (versions

CVE-2026-28153: Missing Authorization

Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

PT-2026-80825

Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...

The vulnerability of the process_files_from_worker() function in the framework/wazuh/core/cluster/master.py file of the security monitoring and threat detection platform for Wazuh allows a perpetrator to execute arbitrary code.

The vulnerability of the processfilesfromworker function in the framework/wazuh/core/cluster/master.py file of the security monitoring and threat detection platform Wazuh is related to improper external manipulation of file names or paths. Exploiting this vulnerability could allow a remote attack...

WordPress Quiz And Survey Master plugin < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR vulnerability

Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Quiz And Survey Master versions 11.2.4...

WordPress Quiz And Survey Master plugin < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR vulnerability

Contributor+ Arbitrary Quiz Text Settings Update via IDOR vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Quiz And Survey Master versions 11.2.4...

WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ian Ho Shim in WordPress Plugin Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions = 1.7.1...

WordPress PPWP: Password Protect Pages, Posts & Full or Partial Content plugin <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure vulnerability

Improper Authorization To Authenticated Contributor+ Master Password Exposure vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin PPWP versions = 1.9.15...

CVE-2026-49441 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-49441

Wazuh versions 4.3.0 through 4.14.6 and 5.0.0-beta3 are affected by an arbitrary file write vulnerability in the cluster master component. The non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json...

CVE-2026-49441 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-48024 Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...