CVE-2026-81782

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

PT-2026-89429

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

WordPress WP Docs plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin WP Docs versions = 2.3.4...

CVE-2026-78279

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

EUVD-2026-64786

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78279 WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

EUVD-2026-64836

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

PT-2026-80815

Unauthenticated Cross Site Request Forgery CSRF in Fluent Support Pro = 2.3.1 versions...

CVE-2026-66706 WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...

WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Subscribe to Comments versions = 2.3.1...

CVE-2026-18650 Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS

Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1...

CVE-2026-17070

Technical details such as affected product/version, root cause, and remediation are not publicly available in the provided documents; monitor for updates.

Security Bulletin:lxml Local File Access Vulnerability: Fixed in 6.1.0

Summary lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration with resolveentities=True allows untrusted XML input to read local files. Setting the resolveentities option explicitly to...

CVE-2026-13332 Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...

CVE-2026-65463

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

CVE-2026-65463 WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

WordPress WP Hotel Booking plugin <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass vulnerability

Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass vulnerability discovered by valent1 in WordPress Plugin WP Hotel Booking versions = 2.3.1...

CVE-2026-15702 tamagui config.ts updateConfig prototype pollution

A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/config.ts. Such manipulation leads to improperly controlled modification of object prototype attributes. The attack may be performed from remote. Upgrading to...

PT-2026-58112

A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/config.ts. Such manipulation leads to improperly controlled modification of object prototype attributes. The attack may be performed from remote. Upgrading to...

CVE-2026-11901 WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler

The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the webhookprocesspaypalstandard IPN handler selecting its PayPal validation endpoint from the attacker-controlled $REQUEST'testipn...