EUVD-2026-57895

Unauthenticated Local File Inclusion in Foton Core = 1.1.1 versions...

CVE-2026-66653

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

CVE-2026-66450

Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...

CVE-2026-61962

Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...

EUVD-2026-57959

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28176

CVE-2026-28176 involves the WordPress Booking Activities plugin (

CVE-2026-28176 WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28149

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28149 WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

EUVD-2026-57947

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-28149

The CVE-2026-28149 entry covers an Unauthenticated PHP Object Injection in the WordPress Headless Single Sign On plugin versions &lt;= 1.6. The underlying issue is a PHP object injection vulnerability that can be exploited without authentication, leading to high impact on confidentiality, integri...

CVE-2026-27380

CVE-2026-27380 affects the WordPress Car Rental Manager plugin

EUVD-2026-57932

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-27380 WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

EUVD-2026-57830

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-14182 Customer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication Bypass

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-14355

A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...