CVE-2026-81271: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

CVE-2026-78281: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-81274: Missing Authorization

Subscriber Broken Access Control in Ditty = 3.1.67 versions...

CVE-2026-78285: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

CVE-2026-78283: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...

CVE-2026-78261: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Realtyna Organic IDX plugin = 5.4.1 versions...

CVE-2026-32566: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32479: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-78288: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Beautiful Taxonomy Filters = 2.4.6 versions...

CVE-2026-37065: Files or Directories Accessible to External Parties

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=...

CVE-2026-69658: Cleartext Transmission of Sensitive Information

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions...

CVE-2026-59300: Insertion of Sensitive Information into Log File

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-81093: Server-Side Request Forgery (SSRF)

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

CVE-2026-78292: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Hash Form = 1.4.1 versions...

CVE-2026-81625: Out-of-bounds Write

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test VT on the affected products to trigger a stack buffer overflow and gain full access on the compromised system...

CVE-2026-78286: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Geo Controller = 8.9.8 versions...

CVE-2026-27330: Missing Authorization

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

CVE-2026-81101: Exposure of Sensitive Information to an Unauthorized Actor

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

CVE-2026-59315: Uncontrolled Resource Consumption

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

CVE-2026-59306: Deserialization of Untrusted Data

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...