WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aarush Gaur in WordPress Plugin Dokan versions = 5.3.2...

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aarush Gaur in WordPress Plugin Dokan versions = 5.3.2...

WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Posts Table with Search & Sort versions = 1.4.14...

WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by MinKhoy - VinSOC in WordPress Plugin Forminator versions = 1.58.3...

WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

Content Injection vulnerability discovered by Filip Kowalski in WordPress Plugin Forminator versions = 1.58.3...

CVE-2026-121554

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

CVE-2026-121546

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...

CVE-2026-74846

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text...

CVE-2026-121554 cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

CVE-2026-121554

The cordova-plugin-advanced-http library, versions 1.5.0 through 3.3.1 , is vulnerable to an information disclosure flaw. The root cause is that the JavaScript layer passes jar-built Cookie headers as ordinary request headers. Consequently, if a request is redirected to a third-party host via an ...

EUVD-2026-115899

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

CVE-2026-121548 nnn through 5.3 OS Command Injection via togglex Plugin

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

CVE-2026-121548 nnn through 5.3 OS Command Injection via togglex Plugin

Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as...

EUVD-2026-115891

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...

CVE-2026-121546 ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...

CVE-2026-121546

ruTorrent versions prior to 5.3.20 are vulnerable to a path traversal flaw within the datadir plugin . The issue arises because the correctDirectory() function fails to resolve symbolic links, allowing authenticated users to bypass the topDirectory jail . By submitting a datadir path via a symlin...

CVE-2026-76124

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...

EUVD-2026-115810

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the sendfeedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content...

Exploit for CVE-2026-116512

CVE-2026-116512 - Project Manager RCE Cyp1337 Edition !Pyt...

CVE-2026-74846

A flaw was found in Catalyst::Plugin::Authentication. The legacy password verification mechanism performs non-constant-time string comparisons when checking passwords and cryptographic hashes. A remote attacker can exploit this timing discrepancy by measuring response-time differences to...