CVE-2026-107848

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

CVE-2026-107848

The Contao Open Source CMS (versions 4.0.0 until 5.3.50 and 5.7.12) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is that RequestTokenListener only validates the REQUEST_TOKEN for POST requests, while the declarative GET guard only activates when an act parameter is pr...

CVE-2026-107848 Contao: Cross-site request forgery in custom backend actions

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUESTTOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter vulnerability

Authenticated Custom+ Privilege Escalation to 'user' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin Groundhogg versions = 4.9...

GHSA-PVGV-GCP7-V38G Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Vulnerability Summary nginx-ui's Node.Secret is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a URL query parameter ?nodesecret=, causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs,...

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Vulnerability Summary nginx-ui's Node.Secret is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a URL query parameter ?nodesecret=, causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs,...

WordPress Blocksy Companion plugin <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter vulnerability

Unauthenticated Privilege Escalation to 'role' Parameter vulnerability discovered by Sawyer in WordPress Plugin Blocksy Companion versions = 2.1.58...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory versions 2.8.188 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the email parameter Contact Email custom field’s htmlvarname. It may lead to storage-based cross-site scripting attacks...

WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details vulnerability

Unauthenticated Sensitive Information Exposure in 'phone' Parameter to booklyrenderdetails vulnerability discovered by R3D in WordPress Plugin Bookly versions = 28.4...

CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-107807

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-107807

The Nginx UI web interface (versions 2.0.0 through 2.5.0 ) is vulnerable to Node Secret Credential Exposure because it accepts the Node.Secret master credential via the node_secret URL query parameter. This occurs instead of requiring the X-Node-Secret header, potentially exposing the secret in a...

EUVD-2026-95882

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-107803

The open-source workflow management software ProcessMaker is vulnerable to SQL injection in the GET /api/1.0/tasks endpoint prior to version 2026.14.3 . The root cause is located in ProcessMaker raits askcontrollerindexmethods::applycolumnordering(), where the application concatenates a user-cont...

CVE-2026-107803

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the "GET /api/1.0/tasks" endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because "ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering" concatenates a...

CVE-2026-89235

The Testimonials by BestWebSoft WordPress plugin, versions 1.0.5 through 1.0.8 , is vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query . This allows unauthentic...

CVE-2026-89235 Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...

BIT-THRIFT-2026-94635 Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94633 Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...