CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66640

Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...

CVE-2026-66639

WPZOOM Forms – Contact Form Plugin for Gutenberg (WordPress) contains a Contributor Cross Site Scripting (XSS) vulnerability affecting versions

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66627

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

EUVD-2026-60916

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32474 WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32466

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

EUVD-2026-60890

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

BIT-GITLAB-2026-8667 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

BIT-GITLAB-2026-4879 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to...

BIT-GITLAB-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

BIT-GITLAB-2025-9486 Incorrect Privilege Assignment in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege...

tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

WordPress WPML Multilingual CMS plugin <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter vulnerability

Authenticated Translator+ SQL Injection via 'sorting' Parameter vulnerability discovered by momopon1415 in WordPress Plugin Multilingual CMS versions = 4.9.5...

ANT-2026-SXD0NN2P · supabase/supabase · SQL Injection

sql-injection high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-SXD0NN2P: Link-driven SQL injection via table-editor filter ARRAY bypass The Supabase Studio Table Editor...