CVE-2026-93527: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...

CVE-2026-93623: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...

CVE-2026-93622: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPS Limit Login = 1.5.9.3 versions...

CVE-2026-93620: Missing Authorization

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

CVE-2026-87898: Improper Neutralization of Special Elements used in an OS Command

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-94391: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...

Karma Pro 0.10

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

CVE-2026-93529: Missing Authorization

Contributor Broken Access Control in WSP MCP – AI Agents Connector = 2.7.0 versions...

CVE-2026-94118: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...

CVE-2026-5695: Unrestricted Upload of File with Dangerous Type

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...

CVE-2026-95529: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...

CVE-2026-75432

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent, and Scanner::PushIndentTo components...

DEBIAN-CVE-2026-75432

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent, and Scanner::PushIndentTo components...

CVE-2026-75432

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent, and Scanner::PushIndentTo components...

UBUNTU-CVE-2026-75432

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent, and Scanner::PushIndentTo components...

CVE-2026-25265: Creation of Temporary File With Insecure Permissions

Privilege escalation due to weak configuration while temporary file handling...

CVE-2026-75432

A vulnerability exists in yaml-cpp version 0.9.0 where a remote attacker can obtain sensitive information . The flaw is located within the src/scanner.cpp file, specifically affecting the Scanner::PopIndent() and Scanner::PushIndentTo() components. The issue is caused by a flaw in how the scanner...

PT-2026-97021

Name of the Vulnerable Software and Affected Versions yaml-cpp version 0.9.0 Description A remote attacker can obtain sensitive information through the src/scanner.cpp file, specifically within the Scanner::PopIndent and Scanner::PushIndentTo functions. Recommendations At the moment, there is no...

Zoho ManageEngine ADSelfService Plus: CVE-2026-74849: Remote code execution vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

CVE-2026-63278: Exposure of Sensitive Information to an Unauthorized Actor

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...