CVE-2026-66648: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Jawn = 1.4.2 versions...

CVE-2026-66650: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in FreightCo = 1.1.15 versions...

CVE-2026-63693: Creation of Temporary File in Directory with Insecure Permissions

Dell Client BIOS contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Write...

CVE-2026-78278: Authorization Bypass Through User-Controlled Key

Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-32559: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-78259: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

CVE-2026-28162: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-78269: Server-Side Request Forgery (SSRF)

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-32477: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...

CVE-2026-78258: Missing Authorization

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-59295: Undefined Security Weakness

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service DoS condition due to an unbounded memory leak. Micrometer 1.17.0 Micrometer 1.16.0 - 1.16.6 Micrometer 1.15.0 - 1.15.12 Micrometer 1.14.0 - 1.14.16 Micrometer 1.9.18 and earlier...

CVE-2026-66584: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-32478: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...

CVE-2026-78272: Missing Authorization

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-32555: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Boost = 2.0.4 versions...

CVE-2026-28166: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-28152: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...

CVE-2026-32560: Improper Control of Filename for Include/Require Statement in PHP Program

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator = 1.4 versions...

CVE-2026-78284: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78290: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...