Hash Form <= 1.1.0 - Arbitrary File Upload

The Hash Form Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction' function in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to upload arbitrary files on...

Zimbra Collaboration Suite - Memcached Command Injection

Zimbra Collaboration Suite versions 8.8.15 and 9.0 contain a memcached command injection vulnerability that allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, leading to cache poisoning and potential credential theft. id: CVE-2022-27924 info: name:...

Debug Endpoint pprof - Exposure Detection

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8,...

EUVD-2026-49656

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.6 versions...

EUVD-2026-49668

Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...

EUVD-2026-49664

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

EUVD-2026-49663

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

EUVD-2026-49662

Unauthenticated Cross Site Scripting XSS in GetGenie = 4.4.3 versions...

EUVD-2026-49661

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.3 versions...

EUVD-2026-49659

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

EUVD-2026-49658

Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...

EUVD-2026-49657

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

EUVD-2026-49667

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

EUVD-2026-49665

Unauthenticated Cross Site Scripting XSS in Spam protection, AntiSpam, FireWall by CleanTalk = 6.82 versions...

PT-2026-65390

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...

EUVD-2026-49863

schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openaispeech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length...

PT-2026-65505

NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service an...

CVE-2026-51263

schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openaispeech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length...

PT-2026-65524

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix...

PT-2026-65388

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...