CVE-2026-8622

The Image Sizes on Demand plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHPSELF Server Variable in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

WordPress Bulk SEO Image plugin <= 1.1 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by nishida azuka in WordPress Plugin Bulk SEO Image versions = 1.1...

WordPress Book a Room Event Calendar plugin <= 1.9 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by swat in WordPress Plugin Book a Room Event Calendar versions = 1.9...

CVE-2026-46186 affecting package kernel for versions less than 6.6.141.1-1

CVE-2026-46186 affecting package kernel for versions less than 6.6.141.1-1. An upgraded version of the package is available that resolves this issue...

PT-2026-50796

Name of the Vulnerable Software and Affected Versions Relyra versions 1.0.0 through 1.1.0 Description Relyra is a SAML 2.0 Service Provider library for Elixir and Phoenix that accepts forged SAML signatures. This occurs because the SignatureValue is not cryptographically verified before the libra...

EUVD-2026-37629

Unauthenticated Insecure Direct Object References IDOR in Clean Login = 1.15 versions...

EUVD-2026-37596

Unauthenticated Local File Inclusion in ChapterOne = 1.7 versions...

EUVD-2026-37672

Unauthenticated Local File Inclusion in Mikado Core = 1.6 versions...

EUVD-2026-37676

Unauthenticated PHP Object Injection in Mildhill = 1.5 versions...

EUVD-2025-210233

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

EUVD-2025-210236

Unauthenticated Local File Inclusion in Tipsy = 1.1 versions...

EUVD-2025-210234

Unauthenticated Local File Inclusion in Orpheus = 1.3 versions...

CVE-2025-69170

Unauthenticated Local File Inclusion in Eventicity = 1.5 versions...

CVE-2025-69174

Unauthenticated Local File Inclusion in Etude = 1.6 versions...

CVE-2025-69164

Unauthenticated Local File Inclusion in Skyward = 1.10 versions...

CVE-2025-69127

Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...

CVE-2025-69120

Unauthenticated Local File Inclusion in Dazzle = 1.0.0 versions...

CVE-2026-40754

Unauthenticated PHP Object Injection in Roisin = 1.4 versions...

CVE-2025-69131

Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site = 1.0.7 versions...

EUVD-2026-37690

Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...