CVE-2026-19034

CVE-2026-19034 affects Shibby Tomato 1.28.0000. The vulnerability lies in the function new_qoslimit_stop in the file /tmp/qoslimittc_stop.sh; manipulating the argument wan_iface can lead to an OS command injection. The attack is remote, and the exploit has been publicly disclosed. The issue is ti...

CVE-2025-15039 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...

CVE-2025-15039 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16537 Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

CVE-2026-11588

The EONSR AEO Agent WordPress plugin (versions

CVE-2026-16954

The AI Engine WordPress plugin (versions prior to 3.6.4 ) contains a sensitive information disclosure vulnerability. The plugin fails to redact secret configuration values before exposing them within an admin page's inline script data . This flaw allows users with the Editor role to read stored t...

EUVD-2026-53726

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-18400 Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-18325

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-2998)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-3048)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

PT-2026-68812

Name of the Vulnerable Software and Affected Versions league/commonmark versions 1.5.0 through 2.8.3 Description The AttributesExtension in the library contains a flaw where the href and src unsafe-link filters can be bypassed. This occurs because the filterAttributes function and the...

PT-2026-68579

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.80 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendation...

PT-2026-68599

Name of the Vulnerable Software and Affected Versions Subscribe to Comments versions prior to 2.3.2 Description An Author Cross Site Scripting XSS issue exists in the Subscribe to Comments plugin. Cross Site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages...

PT-2026-68596

Name of the Vulnerable Software and Affected Versions Rank Math SEO versions prior to 1.0.274.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Rank Math SEO to...

PT-2026-68556

Name of the Vulnerable Software and Affected Versions Houzez Property Feed versions prior to 2.5.49 Description The Houzez Property Feed plugin for WordPress contains a stored Cross-Site Scripting XSS flaw. This issue occurs because the software fails to properly sanitize input and escape output,...

PT-2026-68402

Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.6.4 Description The AI Engine WordPress plugin fails to redact secret configuration values before exposing them within an admin page's inline script data. This allows users with the Editor role to access the site'...

PT-2026-68600

Name of the Vulnerable Software and Affected Versions Facebook for WooCommerce versions prior to 3.7.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Facebook fo...