CVE-2026-115366

A flaw was found in OpenBao. An improper authorization vulnerability in the plugin catalog interface allows an authenticated user with privileged access in a child namespace to modify system-wide plugin configurations. Because access to these endpoints is not restricted to the root namespace, an...

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin myCred versions = 4.0.2...

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daimi in WordPress Plugin myCred versions = 4.0.2...

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aarush Gaur in WordPress Plugin Dokan versions = 5.3.2...

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aarush Gaur in WordPress Plugin Dokan versions = 5.3.2...

WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Posts Table with Search & Sort versions = 1.4.14...

WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by MinKhoy - VinSOC in WordPress Plugin Forminator versions = 1.58.3...

WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

Content Injection vulnerability discovered by Filip Kowalski in WordPress Plugin Forminator versions = 1.58.3...

CVE-2026-121554

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

CVE-2026-121546

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...

CVE-2026-121554

The cordova-plugin-advanced-http library, versions 1.5.0 through 3.3.1 , is vulnerable to an information disclosure flaw. The root cause is that the JavaScript layer passes jar-built Cookie headers as ordinary request headers. Consequently, if a request is redirected to a third-party host via an ...

CVE-2026-121554 cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

EUVD-2026-115899

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

CVE-2026-121548 nnn through 5.3 OS Command Injection via togglex Plugin

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

CVE-2026-121548 nnn through 5.3 OS Command Injection via togglex Plugin

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

EUVD-2026-115891

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...

CVE-2026-121546 ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...

CVE-2026-121546

ruTorrent versions prior to 5.3.20 are vulnerable to a path traversal flaw within the datadir plugin . The issue arises because the correctDirectory() function fails to resolve symbolic links, allowing authenticated users to bypass the topDirectory jail . By submitting a datadir path via a symlin...

CVE-2018-7422

CVE-2018-12613 Local file inclusion bug due to no sanitization of user input. Software Affected 1. Wordpress Plugin: Site-Editor v.1.1.1; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: 1. Wordpress URL endpoint 2. A full path file to be retrieved in remote...

CVE-2026-76124

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...