EUVD-2026-115810

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...

Exploit for CVE-2026-116512

CVE-2026-116512 - Project Manager RCE Cyp1337 Edition !Pyt...

CVE-2026-74846

A flaw was found in Catalyst::Plugin::Authentication. The legacy password verification mechanism performs non-constant-time string comparisons when checking passwords and cryptographic hashes. A remote attacker can exploit this timing discrepancy by measuring response-time differences to...

CVE-2026-74846

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text...

CVE-2026-74846

The Catalyst::Plugin::Authentication component in Perl (versions before 0.10029 ) is vulnerable to a timing attack within the legacy password verifier. The flaw occurs because the legacy verifier uses eq comparisons for clear-text passwords, crypt hashes, and base64 digests, causing the compariso...

CVE-2026-74846 Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text...

EUVD-2026-115722

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text...

Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw

Synology is urging customers to update the DiskStation Manager DSM software powering its Network Attached Storage NAS devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated...

WordPress WP Fastest Cache – WordPress Cache Plugin plugin <= 1.5.3 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by R3D in WordPress Plugin WP Fastest Cache versions = 1.5.3...

WordPress SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin <= 4.9.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by hamachijp in WordPress Plugin SureCart versions = 4.9.5...

CVE-2026-106004

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status...

CVE-2026-104648

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...

CVE-2026-104647

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...

CVE-2026-103379

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order...

CVE-2026-104648 weMail <= 2.1.6 - Editor+ API Key Disclosure

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...

CVE-2026-103379 WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order...

CVE-2026-103379

The WATI Chat and Notification WordPress plugin (versions through 1.1.8 ) is vulnerable to unauthenticated customer Personally Identifiable Information (PII) disclosure. The root cause is a missing requirement for a valid, non-empty secret on a public endpoint, which allows an attacker to retriev...

CVE-2026-104647 weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...

EUVD-2026-115684

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...

CVE-2026-104648

The weMail WordPress plugin (versions through 2.1.6 ) contains an API Key Disclosure vulnerability. The plugin fails to restrict access to a site-wide third-party email-service API key to administrators, exposing it on an admin screen accessible by users with the Editor role. An attacker with Edi...