EUVD-2026-85040

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...

WordPress The Events Calendar plugin 6.15.16.1-6.17.4 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability

Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.15.16.1-6.17.4...

CVE-2026-6922: Incorrect Authorization

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trashtablebulk and restoretablebulk functions that causes the gua...

CVE-2026-82538

ILIAS before versions 9.22, 10.10, and 11.3 is affected by a SQL injection in the repository trash table . The sort field from HTTP requests is passed directly into the ORDER BY clause without validation against declared sortable columns. Authenticated users with write permission on any container...

CVE-2026-82538 ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated...

CVE-2026-82538 ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated...

CVE-2026-82538: Improper Neutralization of Special Elements used in an SQL Command

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated...

PT-2026-86205

CVE-2026-82538 SQLi in ILIAS 9.22, 10.10, 11.3 lets authenticated users with container write access inject arbitrary SQL via sort param. CVSS 8.8. Unpatched—act now. Details: https://t.co/Emh3Jd8yiK ILIAS valtersit CVE CVEAlert infosec SysAdmin cybersecurity Linux devsecops devops developer...

CVE-2026-11995

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an actio...

EUVD-2026-51752

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an actio...

CVE-2026-11995 Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an actio...

CVE-2026-11995

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9.0. This is due to the plugin not properly verifying that a user is authorized to perform an actio...

CVE-2026-13464

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

OpenClaw: Workspace-derived service PATH could influence trash command selection

Summary Workspace-derived service PATH could influence trash command selection. In affected versions, a workspace-derived environment path could select an unintended trash executable during maintenance. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...

NPM: OpenClaw: Workspace-derived service PATH could influence trash command selection

NPM: OpenClaw: Workspace-derived service PATH could influence trash command selection vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.2...

GHSA-RX78-29QR-5HQ8 OpenClaw: Workspace-derived service PATH could influence trash command selection

Summary Workspace-derived service PATH could influence trash command selection. In affected versions, a workspace-derived environment path could select an unintended trash executable during maintenance. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...

EUVD-2026-37167

OpenClaw: Workspace-derived service PATH could influence trash command selection...

Duplicate Advisory: Workspace-derived service PATH could influence trash command selection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rx78-29qr-5hq8. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows...

GHSA-2W22-3F6X-3HF4 Duplicate Advisory: Workspace-derived service PATH could influence trash command selection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rx78-29qr-5hq8. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows...

CVE-2026-45154

Nextcloud is an open source content collaboration platform. From version 2.6.0 to before version 4.3.0, when a previous collective pages was deleted and the collective was shared view-only, guests with access to the collective were able to access the deleted pages directly from the trashbin. This...