CVE-2026-73380: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73365: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...

CVE-2026-73358: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...

CVE-2026-73355: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...

CVE-2026-73350: Incorrect Privilege Assignment

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CVE-2026-73345: Improper Neutralization of Special Elements used in an SQL Command

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...

CVE-2026-73343: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73339: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73338: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-73190: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5...

CVE-2026-73404: Missing Authorization

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73400: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73379: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73377: Missing Authorization

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73375: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73367: Inclusion of Functionality from Untrusted Control Sphere

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73348: Missing Authorization

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2021-43718: Authentication Bypass Using an Alternate Path or Channel

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP...

CVE-2026-69160: Authorization Bypass Through User-Controlled Key

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...