UBUNTU-CVE-2026-93012

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

WordPress Simple Membership plugin < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version vulnerability

Unauthenticated Stored XSS via Stripe Webhook API Version vulnerability discovered by Duy Tran in WordPress Plugin Simple Membership versions 4.7.5...

CVE-2026-93012: Improper Neutralization of Special Elements used in an OS Command

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

WordPress Really Simple Security plugin 8.1.6-9.8.2 - Unauthenticated Unbounded Option Growth vulnerability

Unauthenticated Unbounded Option Growth vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Really Simple SSL versions 8.1.6-9.8.2...

CVE-2026-15743

A flaw was found in Catalyst::Plugin::Static::Simple for Perl. The servestatic method incorrectly sets the Cache-Control header to "public" for all responses. This misconfiguration allows intermediate proxies to store sensitive content, including responses from authenticated sessions, in shared...

CVE-2026-88798

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

EUVD-2026-82676

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-88798 Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-88798

The Really Simple Security WordPress plugin (versions before 9.8.3 ) is vulnerable to an unbounded option growth flaw. The root cause is a failure to validate a client-supplied address value before using it as a storage key for one of the plugin's options. This allows unauthenticated attackers to...

CVE-2026-88798: Uncontrolled Resource Consumption

The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages...

CVE-2026-74000

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

EUVD-2026-81514

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

CVE-2026-74000

CVE-2026-74000 affects the WordPress Simple Membership plugin in versions ≤ 4.8.2 . The vulnerability is a Broken Access Control flaw discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 5.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N , indicating a network-exploitable...

CVE-2026-74000 WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

CVE-2026-74000 WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

WordPress Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin <= 9.8.1 - Missing Authorization to 2FA Bypass vulnerability

Missing Authorization to 2FA Bypass vulnerability discovered by Michael Holmquist in WordPress Plugin Really Simple SSL versions = 9.8.1...

CVE-2026-74000: Missing Authorization

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Membership versions = 4.8.2...

CVE-2026-82519

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler...