PT-2026-96659

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description The plugin contains an Insecure Direct Object Reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in t...

CVE-2026-52741 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

CVE-2026-85574

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574

The Unbounce Landing Pages WordPress plugin, in versions before 1.1.5 , is vulnerable to a Reverse-Proxy Target Hijack via the set_unbounce_domains function. The flaw exists because the plugin fails to perform proper authorisation checks when updating the configuration for its front-end proxy. Th...

EUVD-2026-83503

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress (versions up to and including 2.4.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'pages' parameter in admin settings, caused by insufficient input sanitization and output escaping. An authenticated attacker with administrator-level ...

CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PhpMyAdmin <4.8.2 - Local File Inclusion

PhpMyAdmin before version 4.8.2 is susceptible to local file inclusion that allows an attacker to include view and potentially execute files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted...

PT-2026-95756

Name of the Vulnerable Software and Affected Versions Unbounce Landing Pages WordPress plugin versions prior to 1.1.5 Description An authorization bypass exists when updating the configuration used by the front-end proxy. This allows any authenticated user, including those with subscriber-level...

PT-2026-95734

Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions prior to 2.4.13 Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions or higher to perform Stored Cross-Site...

CVE-2026-85574: Missing Authorization

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

PT-2026-102433

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=562985572 Crash type: Heap-buffer-overflow READ 1 Crash state: sas7bdat parse all pages pass2 readstat parse sas7bdat fuzz format sas7bdat.c...

WordPress WP2Social Auto Publish plugin <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'pages' Parameter vulnerability discovered by Luca Jungnickel in WordPress Plugin WP2Social Auto Publish versions = 2.4.12...

CVE-2026-93456

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

EUVD-2026-82616

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2026-93456 django-page-cms through 2.0.13 CSRF via admin mutation views

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2026-93456

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. A signed-in editor visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, en...