CVE-2026-84773: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2021-38489: Plaintext Storage of a Password

HDD password plaintext is stored in a UEFI variable...

CVE-2026-82521: Improper Limitation of a Pathname to a Restricted Directory

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...

CVE-2026-84766: Authentication Bypass by Spoofing

Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...

CVE-2026-81281: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81295: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Under Construction = 5.82 versions...

CVE-2026-9853: Incorrect Implementation of Authentication Algorithm

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

CVE-2026-84971: Reachable Assertion

Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...

CVE-2026-85304: Missing Authorization

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

CVE-2026-84778: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning = 6.65 versions...

CVE-2026-84769: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...

CVE-2026-84767: Insufficient Verification of Data Authenticity

Unauthenticated Bypass Vulnerability in BookIt = 2.6.0.3 versions...

CVE-2026-84758: Missing Authorization

Unauthenticated Broken Access Control in Business Directory = 6.4.26 versions...

CVE-2026-84755: Missing Authorization

Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...

CVE-2026-84754: Missing Authorization

Unauthenticated Broken Access Control in WPFunnels = 3.12.13 versions...

CVE-2026-84834: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

CVE-2026-84779: Missing Authorization

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

CVE-2026-84768: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...

CVE-2026-84756: Incorrect Privilege Assignment

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-85309: Missing Authorization

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...