CVE-2026-19702: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8...

CVE-2026-81756: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms = 5.1.24 versions...

CVE-2026-82229: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

CVE-2026-82221: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-81764: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Email Essentials = 6.0.6 versions...

CVE-2026-81765: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Tailored Tools = 3.0.2 versions...

CVE-2026-82863: Insufficient Logging

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring...

CVE-2026-81290: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...

CVE-2026-81778: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Kalles Addons = 1.0.6 versions...

CVE-2026-82224: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SliceWP = 1.2.10 versions...

CVE-2026-82226: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...

CVE-2026-81298: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in LeadConnector = 4.0.5 versions...

CVE-2026-81768: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

CVE-2026-81293: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-82852: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

CVE-2026-81758: Missing Authorization

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-81296: Missing Authorization

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-19616: Missing Authorization

Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2...

CVE-2026-81779: Improper Validation of Specified Quantity in Input

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48...

CVE-2026-81278: Missing Authorization

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...