EUVD-2026-49661

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.3 versions...

EUVD-2026-49659

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

EUVD-2026-49658

Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...

EUVD-2026-49657

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

EUVD-2026-49667

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

EUVD-2026-49665

Unauthenticated Cross Site Scripting XSS in Spam protection, AntiSpam, FireWall by CleanTalk = 6.82 versions...

PT-2026-65449

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.5.9 via the wpbot send email transcript free. This makes it possible for unauthenticated attackers to exfiltrate full...

PT-2026-65450

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs send email AJAX handler. This is due to the wpcs send email function being registered on both wp ajax wpcs send email and wp ajax nopriv wpcs send email with no nonce...

PT-2026-65396

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle restore step function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

PT-2026-65388

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax function and the serveTemplatePdf REST route which is registered...

PT-2026-65394

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...

AT&T's Arris BGW210-700 gateway contains authentication bypass vulnerability in LAN-side management interface

Overview Firmware versions 2.7.7 and earlier of the Arris BGW210-700 residential gateway contain an authentication bypass vulnerability, tracked as CVE-2026-16771, that allows any unauthenticated LAN-side user to read sensitive configuration data and modify device settings through web management...

Oracle Enterprise Manager Cloud Control (July 2026 CPU)

The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Ne...

Oracle APEX (CVE-2026-54285) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: Third Party OpenTelemetry as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: Third Party OpenTelemetry. Easily exploitable vulnerability allows...

Oracle APEX (CVE-2026-60156) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: General as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: General. Easily exploitable vulnerability allows unauthenticated attacker with network...

PT-2026-65410

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form datas' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

PT-2026-65389

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

CVE-2026-51263

schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openaispeech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length...

PT-2026-65504

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

PT-2026-65524

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix...