CVE-2026-66639

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

CVE-2026-66638

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66637

Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...

CVE-2026-66636

Contributor Cross Site Scripting XSS in Wise Chat = 3.4 versions...

CVE-2026-66635

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-66633

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66629

Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...

CVE-2026-66627

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-66621

Unauthenticated Cross Site Scripting XSS in Ultimate Dashboard = 3.11.2 versions...

CVE-2026-66620

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-32553

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

CVE-2026-32549

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

CVE-2026-32547

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

CVE-2026-32481

Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-32473

Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...

CVE-2026-32472

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

CVE-2026-32470

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32466

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

CVE-2026-32465

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32464

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32333

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

CVE-2026-28571

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

CVE-2026-28570

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...

CVE-2026-28569

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

CVE-2026-28568

Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28192

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

CVE-2026-73692

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

CVE-2026-15585

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 befo...

CVE-2026-75855

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75854

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without...

CVE-2026-75853

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75851

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75852

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials...

CVE-2026-75850

ArcadeDB before 26.8.1 fails to bind the authenticated principal setCurrentUser on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer LocalBucket.checkPermissionsOnFile does not execute for these handlers. In...

CVE-2026-75846

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75845

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the setserversetting MCP server-level tool. SetServerSettingTool.execute gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-roo...

CVE-2026-75844

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

CVE-2026-75843

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

CVE-2026-75842

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...

CVE-2026-75840

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type to access java.util.zip.ZipFile or...