CVE-2026-89324

The Basel Post Types plugin for WordPress (versions

CVE-2026-124194

A vulnerability in Microsoft Outlook allows an unauthenticated attacker to perform spoofing over a network. The issue stems from the product user interface failing to warn users of unsafe actions. Specifically, an attacker can send a specially crafted message file that, when opened by a user, may...

CVE-2026-125350

Google Chrome contains a high-severity use-after-free vulnerability in its XML component , specifically involving the libxslt xsltTestCompMatchDirect pattern match cache. A remote attacker can exploit this flaw via a crafted HTML page to achieve arbitrary code execution within the sandbox, cause ...

CVE-2026-123751

The WP Duplicate WordPress plugin (versions

CVE-2026-114432

The Contact Form 7 WordPress plugin (versions 6.2-6.2.3 ) is vulnerable to an unauthenticated arbitrary file upload due to a lack of validation for file types/extensions and a flaw in temporary-file cleanup. This allows attackers to upload files to the server. On specific configurations, such as ...

CVE-2026-120531

The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 10.47 . The root cause is insufficient input sanitization and output escaping related to the data[ip] parameter. This flaw allows unau...

CVE-2026-118267

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to and including 5.5.89 . The vulnerability exists because the plugin's write endpoints (wpda/app/update, ...

CVE-2026-116751

The Amelia Pro plugin for WordPress (versions up to and including 9.9.1 ) is vulnerable to a time-based SQL Injection via the tag[] parameter. The root cause is insufficient escaping of array keys, which bypasses wp_magic_quotes and allows unauthenticated attackers to craft malicious keys that de...

CVE-2026-118066

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to an Authentication Bypass via Account Takeover in all versions up to and including 5.7.6 . The root cause lies in the OsModel::build_conditions_query() function in lib/models/mode...

CVE-2026-119155

The wpForo Forum plugin for WordPress (versions up to and including 3.2.2 ) is vulnerable to a time-based SQL Injection . The root cause is insufficient escaping and a lack of sufficient preparation on the 'href[locale]' parameter in existing SQL queries. This flaw allows unauthenticated attacker...

CVE-2026-120043

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection in all versions up to and including 1.2.14 . The root cause is insufficient escaping and a lack of proper preparation on the 'email' parameter within the existing SQL query. This flaw allo...

CVE-2026-123218

IBM Aspera Faspex versions 5.0.0 through 5.0.19 are vulnerable to an incorrect authorization flaw (CWE-863 ). This vulnerability allows an authorized user to craft a specific message to bypass authorization mechanisms, potentially leading to full administrative privileges on the file transfer ser...

CVE-2026-19868

The SonicOS SSLVPN service is affected by an authentication enforcement vulnerability (CVE-2026-19868 ) that allows users with valid credentials for an alternate authentication method to bypass SAML authentication controls . This can also lead to the bypass of SAML-enforced multi-factor authentic...

CVE-2026-62856

The help desk and shared mailbox application FreeScout is vulnerable to cross-user notification data disclosure in versions prior to 1.8.226 . The polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while authorization checks are only applied to names with spec...

CVE-2026-109884

The Elementor Website Builder plugin for WordPress is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation . This issue affects versions through 4.3.5 . Exploitation has been observed in the wild, as confirmed by CIRCL re...

CVE-2026-118423

The WP Libre Form WordPress plugin version 1.5.0.1 is vulnerable to remote code execution (RCE) . The root cause is a failure to validate file types during form submissions, which allows unauthenticated attackers to upload PHP files to a web-accessible directory. Once uploaded, these files can be...

CVE-2026-116779

FreeSWITCH versions prior to 1.11.3 are vulnerable to a code injection flaw in the sofia_presence_handle_sip_i_message() function. The vulnerability exists because the software splits the To user of an inbound SIP MESSAGE on a plus sign and treats the preceding string as a chat protocol selector ...

CVE-2026-123158

OpenSSH (versions before 10.6p2 ) on Linux systems using musl libc without PAM is vulnerable to an unauthenticated password authentication bypass, codenamed SSHole . The root cause is a collision where musl libc 's crypt() function returns the literal string * for passwords exceeding 256 bytes, w...

CVE-2026-102895

GPUStack , an open-source GPU cluster manager for AI model serving, is vulnerable to an authentication bypass in versions prior to 2.2.0 . The root cause lies in gpustack/api/auth.py, where the get_current_user function treats loopback request sources as built-in administrators when force_auth_lo...

CVE-2026-120422

Sogou Input Method for Windows versions prior to 16.10 are vulnerable to arbitrary code execution due to an insecure configuration retrieval mechanism in the SGTool.exe component. The application fetches configuration data over unencrypted HTTP connections , enabling attackers to manipulate netwo...