CVE-2026-65557

Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...

CVE-2026-65435

Unauthenticated Broken Access Control in Thrive Leads Version = 10.9.2 versions...

CVE-2026-65436

Editor Arbitrary File Deletion in Kirki = 6.0.13 versions...

CVE-2026-65434

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce = 2.16.1 versions...

CVE-2026-59560

Subscriber Broken Access Control in FundEngine = 1.7.8 versions...

CVE-2026-65433

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-59559

Subscriber Cross Site Scripting XSS in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-59557

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

CVE-2026-59558

Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...

CVE-2026-59556

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-59553

Unauthenticated Cross Site Scripting XSS in Product Feed Manager = 7.6.1 versions...

CVE-2026-59552

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

CVE-2026-59551

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-59550

Unauthenticated SQL Injection in AWP Classifieds = 4.4.7 versions...

CVE-2026-59549

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-59548

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...

CVE-2026-59539

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

CVE-2026-59546

Subscriber Broken Authentication in Hide My WP Ghost = 7.0.06 versions...

CVE-2026-59538

Unauthenticated SQL Injection in GamiPress = 7.9.7 versions...

CVE-2026-59537

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

CVE-2026-59536

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CVE-2026-59534

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-59535

Unauthenticated Broken Access Control in Thrive Product Manager = 10.9.2 versions...

CVE-2026-59533

Unauthenticated SQL Injection in Relevanssi Light = 1.2.2 versions...

CVE-2026-59532

Unauthenticated Other Vulnerability Type in Booking and Rental Manager = 2.7.2 versions...

CVE-2026-59531

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks = 2.10.0 versions...

CVE-2026-59530

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-59528

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

CVE-2026-59529

Unauthenticated Sensitive Data Exposure in Ebook Store = 6.19 versions...

CVE-2026-59527

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-15003

A flaw was found in the GNU Binutils Binary Utilities linker. This vulnerability, a heap-buffer-overflow read CWE-125, occurs when the linker processes a specially crafted 32-bit XCOFF Extended Common Object File Format object file. An attacker could exploit this by providing a malicious file,...

CVE-2026-17514

A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...

CVE-2026-65876

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

CVE-2026-65877

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...

CVE-2026-65879

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms...

CVE-2026-65766

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...

CVE-2026-65878

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...

CVE-2026-17513

A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggmlftypetoggmltype of the file ggml/src/ggml.c. The manipulation of the argument ftype results in reachable assertion. The attack requires a local approach. The project was informed of the problem early through ...

CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

CVE-2026-17512

A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function logmelspectrogram of the file src/whisper.cpp. The manipulation leads to out-of-bounds read. The attack needs to be performed locally. The pull request to fix this issue awaits acceptance...

CVE-2026-59690

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

CVE-2026-59689

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system...

CVE-2026-59688

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...

CVE-2026-59687

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location...

CVE-2026-59686

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

CVE-2026-56538

An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users...

CVE-2026-56537

HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of request data...

CVE-2026-12991

The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot APK v5.5.0 exposes the system to man-in-the-middle attacks. An attacker located on the local network can use ARP spoofing and selective traffic blocking techniques to...

CVE-2026-12990

An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...

CVE-2026-12989

A lack of authentication in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization...