CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

CVE-2026-88004

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...

CVE-2026-84821

Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...

CVE-2026-84816

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

CVE-2026-84819

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-81805

Unauthenticated Privilege Escalation in SiteSkite = 2.1.5 versions...

CVE-2026-81796

Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...

CVE-2026-81799

Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce = 4.6.4 versions...

CVE-2026-81804

Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration = 2.4.2 versions...

CVE-2026-81800

Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...

CVE-2026-81794

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

CVE-2026-81795

Unauthenticated Cross Site Scripting XSS in Page Visits Counter Lite = 1.2.3 versions...

CVE-2026-81793

Unauthenticated Broken Access Control in Salon booking system = 10.31.5 versions...

CVE-2026-81786

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

CVE-2026-81787

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-81789

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...

CVE-2026-81784

Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...

CVE-2026-81785

Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...

CVE-2026-78536

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

CVE-2026-66674

Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...