EUVD-2026-63317

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-74014

A Subscriber (low-privileged WordPress user) in the IT Residence theme

CVE-2026-74016

The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...

CVE-2026-74016 WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

CVE-2026-73998

The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.

EUVD-2026-63313

Subscriber SQL Injection in WP w3all phpBB = 3.0.5 versions...

CVE-2026-73992 WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73992

The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...

EUVD-2026-63311

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

EUVD-2026-63310

Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...

CVE-2026-66677 WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

EUVD-2026-63305

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

EUVD-2026-63301

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66594

The WordPress Persistent Login plugin (versions ≤ 3.1.0) has a subscriber-level SQL injection vulnerability exploitable over the network with low privileges. CVSS 8.5 (HIGH) reflects high confidentiality impact and low availability impact. No in-the-wild exploitation is reported. Upgrade to a ver...

EUVD-2026-63267

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

CVE-2026-77079

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. The code validated only that the target role existed and was project-scoped, but performed no project-level authorization check . A user holding only the narrow role:manageProjec...

CVE-2026-77079 n8n before 2.34.1 Authorization Bypass via Custom Role Deletion

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

CVE-2026-77079 n8n before 2.34.1 Authorization Bypass via Custom Role Deletion

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

WordPress EWWW Image Optimizer plugin <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability discovered by UKO - Korea univ. in WordPress Plugin EWWW Image Optimizer versions = 8.7.3...

OESA-2026-3423 postgresql-17 security update

PostgreSQL client programs Security Fixes: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the...