Exploit for CVE-2026-14281

CVE-2026-14281 — WAWP Automation Web Platform Unauthenticate...

CVE-2026-96766

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

CVE-2026-93897

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

CVE-2026-14281 Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

CVE-2026-14281

The Automation Web Platform (WAWP) plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 4.8.6 . The root cause is a lack of permission enforcement on the POST /wp-json/wawp/v1/signup/ REST route and the absence of a key allowlist in the finish...

EUVD-2026-86541

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

EUVD-2026-86533

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field e.g., 'phone' in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. Th...

EUVD-2026-86529

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

@htyf-mp/cli (>=0.6.0, <=0.7.6), @htyf-mp/taro-plugin-platform (>=0.6.0, <=0.7.5) +1 more potentially affected by CVE-2026-97724 via react-native-worklets (0.12.1)

react-native-worklets NPM version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on react-native-worklets and may be impacted: - @htyf-mp/cli =0.6.0, =0.6.0, =0.1.5, =0.1.11 Source cves: CVE-2026-97724 Source advisory: MEND:CVE-2026-97724...

OESA-2026-4113 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

OESA-2026-4114 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an...

Linux Distros Unpatched Vulnerability : CVE-2026-67222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited...

PT-2026-98992

JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...

PT-2026-98419

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress plugin versions 1.9 through 3.7.49 Description Insufficient verification occurs when a member requests enrollment in a course. The plugin fails to confirm if the requested course is included in the user's membership...

CVE-2026-96766: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businesshours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This make...

PT-2026-98906

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description When the stream plugin is enabled, the stream protocol stores the...

PT-2026-98908

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.21 RabbitMQ versions 4.1.x prior to 4.1.14 RabbitMQ versions 4.2.x prior to 4.2.7 RabbitMQ versions 4.3.x prior to 4.3.1 Description An atom exhaustion issue exists when the Management plugin is enabled. A...

CVE-2026-78397: Server-Side Request Forgery (SSRF)

The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn fr...

CVE-2026-88848: Incorrect Authorization

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...

PT-2026-98904

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description An issue exists where the mechanisms/1 function applies list to atom/1 ...