CVE-2026-104067: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes,...

CVE-2026-104062: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage...

CVE-2026-89435: strategy11team: The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is…

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in...

CVE-2026-119714: joedolson My Calendar - Accessible Event Manager: My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows…

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mcsearchresults in src/my-calendar-search.php without bracket encoding before...

PT-2026-133776

Name of the Vulnerable Software and Affected Versions Transliterator versions 2.5.13 and earlier Description An unauthenticated attacker can perform a SQL Injection, which allows the execution of arbitrary SQL queries to read or modify the site database. This issue occurs within a CMS plugin...

PT-2026-133793

Name of the Vulnerable Software and Affected Versions LeadSnap versions 1.25 and earlier Description An unauthenticated attacker can perform a PHP Object Injection by sending crafted input to the lead plugin. This occurs when the application unserializes untrusted data, which can lead to the...

PT-2026-133281

The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts function in versions up to, and including, 12.0.0. The handler verifies a static nonce 'contentegg metabox' and the generic 'edit posts'...

PT-2026-134445

Name of the Vulnerable Software and Affected Versions Webmention plugin for WordPress versions prior to 5.10.2 Description Stored Cross-Site Scripting occurs via the Open Graph og:title meta tag of a webmention source URL. The issue stems from insufficient input sanitization where Meta::add...

CVE-2026-104066: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...

CVE-2026-112347: Themeum Kirki: Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST…

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/pageid route and the savepagedata, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware...

CVE-2026-111487: qt Qt Framework: An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module.

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...

PT-2026-133570

Name of the Vulnerable Software and Affected Versions Qt Framework versions prior to 6.12.0-2.1 Description An out-of-bounds write issue exists in the assimp scene import plugin of the Qt3D module. An out-of-bounds write occurs when a program writes data past the end of the intended buffer, which...

CVE-2026-114444: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its…

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress...

CVE-2026-118698: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

PT-2026-133618

Name of the Vulnerable Software and Affected Versions Scribus versions prior to 1.6.7 Scribus versions 1.7.x prior to 1.7.4 Description An out-of-bounds read exists in the Mac PICT image loader and import plugin during the decoding of planar pixel data. A remote attacker can provide a specially...

CVE-2026-104063: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leadi...

CVE-2026-114443: Unknown: The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the…

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an...

CVE-2026-104065: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap...

PT-2026-133299

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file url' parameter parameter. This is due to insufficient URL prefix validation in...

PT-2026-133689

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without...