CVE-2026-55738 Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name field

A stack-based buffer overflow exists in the rawtoheader function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source...

CVE-2026-9690

Unauthenticated Arbitrary File Download in WP Media folder Addon = 4.0.1 versions...

CVE-2026-54803

Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.4 versions...

CVE-2026-54188

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...

CVE-2026-54194

Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...

CVE-2026-54189

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...

CVE-2026-42385

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-40768

Unauthenticated Insecure Direct Object References IDOR in Salon booking system = 10.30.24 versions...

CVE-2026-40761

Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...

CVE-2026-40747

Subscriber Arbitrary File Upload in Ecommerce Zone = 0.9.7 versions...

CVE-2026-40749

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

CVE-2026-40746

Subscriber Arbitrary File Upload in Restaurant Zone = 0.7.8 versions...

CVE-2026-40748

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

CVE-2026-40753

Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...

CVE-2026-40726

Unauthenticated Broken Access Control in User Registration Stripe = 1.3.14 versions...

CVE-2026-39580

Unauthenticated PHP Object Injection in Micdrop = 1.3.1 versions...

CVE-2026-39595

Author Broken Access Control in W3 Total Cache = 2.9.1 versions...

CVE-2026-39539

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking = 2.1.2 versions...

CVE-2026-39438

Unauthenticated SQL Injection in ListingPro = 2.9.10 versions...

CVE-2026-32967

Incorrect Authorization vulnerability of /v2 experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...