CVE-2026-92536: Improper Control of Generation of Code

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Jakub Herman in WordPress Plugin ProfilePress versions = 4.17.4...

CyBroHttpServer-v1.0.3-Directory-Traversal

ثغرة اجتياز الدليل في CyBroHttpServer الإصدار 1.0.3 تتيح ثغرة اجتياز الدليل في CyBroHttpServer الإصدار 1.0.3 للمهاجم قراءة معلومات حساسة. CVE-2018-16133 https://vulners.com/cve/CVE-2018-16133 PoC لاستغلال الثغرة، يمكن للمستخدم استخدام طلب 'http://host/../../../../../../../../' للحصول على بعض...

WordPress WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin <= 4.7.3 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability discovered by walid213 in WordPress Plugin Social Icons Widget & Block by WPZOOM versions = 4.7.3...

CVE-2026-32584

The Smart One Click Setup – Complete Demo Import & Export WordPress plugin (versions up to and including 1.4.3 ) is vulnerable to an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201). This flaw allows an attacker to retrieve embedded sensitive data from the plugin. No spec...

CVE-2026-103878

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

UBUNTU-CVE-2026-103878

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

CVE-2026-103878 Apache Directory LDAP API: Injection of plaintext responses during StartTLS

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

CVE-2026-103878

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

CVE-2026-102002

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

CVE-2026-102002 Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-91247

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

CVE-2026-102002 Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

CVE-2026-102002

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.2.6 . The root cause lies in the 'otter_form_widget_filter' parameter, which allows authenticated attackers with ...

EUVD-2026-91246

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-85005 Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as...

CVE-2026-15896

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to a Directory Traversal vulnerability in all versions up to and including 6.3.316 . The root cause lies in the parse_request function, specifically involving the 'sfgtfi' URL path parameter. This flaw allows unauthenti...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

Mlflow <2.9.2 - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6909 info: name: Mlflow 2.9.2 - Path Traversal author: Hyunsoo-ds severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Successful...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...