EUVD-2026-51828

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2025-71404

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

EUVD-2025-210584

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0230...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0226...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0229...

CVE-2026-15662

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bgcolor' parameter in all versions up to, and including, 2.48 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15644

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-17555

WPvivid Backup & Migration for WordPress contains an SQL Injection in the export_data path, fixed in or prior to version 0.9.131. The root cause is insufficient escaping and lack of prepared statements: user-supplied data is parsed in prepare_export_post(), sanitized, JSON-decoded, and then attac...

CVE-2026-17555 WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the exportdata parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values a...

CVE-2026-16091 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipressrank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

CVE-2026-17605

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaidpaymentformelement function. This makes it possible for authenticated attackers, with administrator-level acces...

EUVD-2026-51747

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

CVE-2026-10782

CVE-2026-10782 affects the RealHomes Memberships plugin for WordPress. All versions up to and including 3.0.9 are vulnerable to an authorization bypass in the ims_add_paypal_recurring_membership AJAX action, due to improper verification of user permissions. This allows authenticated users with su...

CVE-2026-14561 Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...

CVE-2026-13596 Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-12696

The wpForo Forum WordPress plugin versions before 3.1.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The application fails to properly sanitize and escape a user profile field—specifically the Profile Location field—before outputting it within an HTML attribute on the public partici...

CVE-2026-58389 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58389 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...