CVE-2026-19116

The User Frontend WordPress plugin before 4.3.11 allows PHP Object Injection via its frontend post editing form. When a submitted post is reopened, user-supplied field values are deserialized without proper sanitization, enabling any authenticated user with subscriber-level access or above to inj...

CVE-2026-19453

JetBackup WordPress plugin (versions 3.1.7.9 through 3.1.23.3) contains a privilege escalation vulnerability. The plugin fails to verify the role or capabilities of a preserved account before granting administrator privileges during a restore or migration, allowing a subscriber-level user to gain...

CVE-2026-16983

The Gutentor WordPress plugin (versions before 4.0.6 ) fails to apply the correct context restriction on one of its REST endpoints , exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role. The vulnerability was discovered by Ezekie...

CVE-2026-19251

The Ultimate Member WordPress plugin before 2.13.0 allows unauthenticated visitors to read comments still awaiting moderation by querying profile activity, due to a missing check on comment approval status and profile privacy. The vulnerability was discovered by Alessandro Greco (Aleff) and Giova...

CVE-2026-14215

CVE-2026-14215 affects the Booking for Appointments and Events Calendar WordPress plugin (also referred to as Amelia ) in versions prior to 2.4.9 . The root cause is a missing authentication or valid request token check before executing the post-booking action chain . An unauthenticated attacker ...

CVE-2026-16966

Solace Extra WordPress plugin before 1.7.0 has a missing authorization and post-status check in its get_elementor_content AJAX action. This allows unauthenticated visitors to read the content of non-published Site Builder parts (draft, pending, private, and trashed) that WordPress would normally ...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery (BEAF) WordPress plugin versions before 4.7.19 are affected by an Author+ Stored XSS . The root cause is that the slider's before-label value is not properly escaped before the plugin's bundled client-side script re-injects it into the DOM. An atta...

CVE-2026-12526

Advanced Custom Fields: Extended WordPress plugin versions before 0.9.2.7 contain an authorization bypass in the update-user action of its front-end Forms module. The plugin only enforces a capability check when the submitted role is administrator or super_admin , failing to verify that the reque...

CVE-2026-15232

The MotoPress Appointment Booking WordPress plugin before 2.4.8 lacks an authorization or ownership check when processing a user-supplied booking identifier on an unauthenticated endpoint , allowing attackers to permanently delete other users' reservations. This is an incomplete fix of CVE-2026-9...

CVE-2026-12865

CVE-2026-12865 affects the Photo Gallery by 10Web WordPress plugin (before 1.8.44 ). Two request parameters (title and paged) are not escaped before being reflected into input-attribute values on admin pages (the Shortcode page and the Galleries/Albums list page). An unauthenticated attacker can ...

CVE-2025-15663

The Ultimate Before After Image Slider & Gallery (BEAF) WordPress plugin, in versions before 4.7.19 , suffers from a Stored XSS due to improper escaping of the slider's after-label value before the bundled client-side script re-injects it into the DOM. Users with the Author role or above can stor...

CVE-2026-33016

This CVE entry is currently reserved with no publicly available technical details. A sighting was recorded on 2026-09-02 from a Telegram channel (HackingTeamGrupoOfficial). Monitor for vendor announcement and further details.

CVE-2026-78657

The SigmaForms Pro – AI Generated Forms WordPress plugin (versions ≤ 1.4.11) is affected by an unauthenticated arbitrary file deletion vulnerability rooted in insufficient file path validation in the delete_submission_files function. An attacker submits a malicious path traversal URL via the plug...

CVE-2026-14357

The DevKit Pro plugin for WordPress is vulnerable to missing authorization in versions up to and including 2.3.0 . The root cause is a missing capability check and nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This allows authe...

CVE-2026-9055

CVE-2026-9055 affects the Amelia (Premium) booking plugin for WordPress in versions 8.0 through 9.6.2 , rated CVSS 9.8 (Critical) . The root cause is insufficient validation of the attacker-controlled type parameter in the customer update endpoint: when externalId is set to 0, a customer can set ...

CVE-2026-3851

The Divi theme for WordPress (versions up to 4.27.6 ) is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format. Two compounding flaws enable the attack: the save-time sanitization filter et_builder_sanitize_dynamic_content_fields() only checks for the @ET-...

CVE-2026-19754

CVE-2026-19754 is a SQL injection vulnerability in Baserow 2.3.3 , specifically in the index() formula function (used for JSONB array extraction). A low-privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a SQL templa...

CVE-2026-84442

A path traversal vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android, specifically in the function getDataColumn of the file ExpoShareIntentModule.kt within the component com.mapquest.android.ace. The attack must be approached locally and requires low privileges with no...

CVE-2026-14982

The WP File Download plugin for WordPress (versions ≤ 6.3.4 ) is vulnerable to arbitrary file deletion via insufficient path validation in the delete function. Authenticated attackers with subscriber-level access or above can exploit a two-stage attack : first calling the file.save endpoint to pe...

CVE-2026-14957

CVE-2026-14957 is a denial-of-service vulnerability in Libreswan (an IPsec/IKE implementation for Linux). In FIPS mode , the add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts the result is non-NULL. When public key extraction fails (e.g., RSA exponent set to 0), the assertion ...

CVE-2026-84441

Piwigo versions up to 16.3.0 are affected by a path traversal vulnerability in the Image Derivative Handler component, specifically in the file i.php . The vulnerable functionality is described as unknown, but manipulation of it allows an unauthenticated remote attacker to traverse the filesystem...

CVE-2026-84438

OpenCart 4.1.0.3 and 4.1.0.4 are affected by a stored cross-site scripting (XSS) vulnerability in the Autocomplete Workflow component, specifically in the file catalog/controller/account/edit.php. The vulnerability is triggered through manipulation of the firstname argument, allowing a remote, au...

CVE-2026-82968

Keycloak identity management service has a flaw in the first-broker-login flow that enables account takeover via social identity provider linking. The verification proof (described in the CVE list as a cross-session email verification proof ) is not strictly bound to the specific upstream identit...

CVE-2026-84437

A cross-site scripting (XSS) vulnerability affects OpenCart 4.1.0.3 and 4.1.0.4 , specifically in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Manipulating the address_1 argument allows a remote, authenticated (low-privilege) attacker to inject scrip...

CVE-2026-84715

FeatherPanel versions before 1.3.7.10 contain a privilege escalation vulnerability in the SubuserController updateSubuser handler. The handler fails to properly validate permissions, allowing an authenticated subuser with minimal access to send a crafted request that modifies their own permission...

CVE-2026-84485

APITable versions through 1.13.0-beta.1 expose an internal organization loadOrSearch endpoint without requiring authentication. This allows unauthenticated attackers to retrieve member names, email addresses, and team hierarchy by querying the endpoint with space identifiers obtained from shared ...

CVE-2026-84484

ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function. An unauthenticated remote attacker can send a UDP datagram to the LTP link service input port with a truncated SDNV value, triggering reads up to nine bytes past buffer boundaries and underflowin...

CVE-2026-84431

A path traversal vulnerability exists in the AirAsia MOVE App (versions up to 12.47.1 on Android). The flaw resides in the function com.airasia.core.utils.RealPathUtil.getRealPath within the component com.airasia.mobile , where manipulation of the _display_name argument allows an attacker to trav...

CVE-2025-33141

This is a reserved CVE candidate with no publicly available technical details regarding the affected product, vulnerability type, or impact. Monitor for updates when the candidate is publicized.

CVE-2026-31278

CVE-2026-31278 affects Suprema BioStar 2 , a biometric access control system, involving the exposure of Active Directory credentials . The NVD entry is still in a reserved state, but a Kitploit tool entry and a CIRCL Telegram sighting (2026-09-02) indicate the vulnerability is being tracked. No s...

CVE-2025-52399

CVE-2025-52399 is a SQL Injection vulnerability in the Institute-of-Current-Students PHP application (version 1.0). The /loginlinkfaculty endpoint fails to sanitize the fid POST parameter before including it in a SQL query, enabling remote attackers to execute arbitrary SQL commands. Exploitation...

CVE-2026-31321

CVE-2026-31321 affects Windows Defender . A published proof-of-concept (PoC) demonstrates that an attacker can disable Defender by manipulating Defender-related folders—specifically by hiding, locking, or protecting them—causing Defender to be removed after a system reboot. Three distinct methods...

CVE-2026-36130

Windows Defender (process MsMpEng.exe) is the affected component. A published proof-of-concept by GitHub user cwjchoi01 demonstrates that, after a reboot, the Defender process is no longer running, indicating the vulnerability can prevent Defender from restarting. The CVE entry remains in reserve...

CVE-2026-84430

gouguoa versions up to 5.10.0/6.0.1 contain a vulnerability in the edit_personal Endpoint (file app/home/controller/Index.php, function update). Manipulation of the position_id argument leads to dynamically-determined object attributes , enabling remote exploitation. The exploit has been publicly...

CVE-2026-84702

facefusion through 3.6.1 is vulnerable to a path traversal flaw in the get_job_file_name function (located in facefusion/jobs/job_manager.py), which fails to normalize job identifiers. An attacker can supply traversal sequences in the job identifier parameter via the unauthenticated HTTP API to w...

CVE-2026-84700

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g., 11221 for the default 9221) that lacks authentication for non-MetaSync messages. The root cause is that the frame dispatcher (DealMessage ) does not require a completed o...

CVE-2026-84701

NocoBase is vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of rich text field values in the read renderer (specifically ReadPretty.tsx). An attacker with create permissions can inject arbitrary HTML with event handlers via the collection API, which then executes ...

CVE-2026-84699

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow, allowing unauthenticated attackers to reset local account passwords and authenticate as those users, resulting in unauthorized access. The vulnerability is rated CVSS 3.1...

CVE-2026-84697

Mailpit (open-source mail testing tool) contains a Server-Side Request Forgery (SSRF) vulnerability in its IsInternalIP deny list function (file: internal/tools/net.go). The deny list fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix , all...

CVE-2026-84698

PX4 Autopilot is affected by a heap buffer overflow in the sd_bench command. The command writes a four-byte block number into a user-supplied sized allocation; invoking it with a block size below four bytes overflows the buffer, potentially allowing arbitrary code execution or a system crash . Th...

CVE-2026-84696

Phison PS3111-S11 controller firmware, in versions through SBFQT1.3 , exposes privileged vendor unique commands (VUC) over the ATA interface with absent or defeatable authentication. Attackers with local access can bypass a weak CRC-16 based unlock handshake or target builds lacking a VUC lock en...

CVE-2026-84695

BookStack versions before 26.05.4 are affected by a stored cross-site scripting (XSS) vulnerability in the drawing upload endpoint , which accepts unvalidated base64 content and stores it without content inspection. Attackers holding editor permissions can upload SVG files containing scripts that...

CVE-2026-84694

Coolify versions before 4.2.0 are affected by a remote code execution vulnerability caused by improper escaping of environment variable key names in Docker commands executed over SSH on managed servers. An authenticated attacker can inject shell metacharacters into environment variable keys, allo...

CVE-2026-84427

CVE-2026-84427 affects zhayujie CowAgent versions up to 2.1.7 . The vulnerability resides in the Bash Tool component, specifically in the file agent/tools/bash/bash.py. The root-cause function is not precisely identified in the CVE description, though a linked GitHub report title references an ou...

CVE-2026-84425

zhayujie CowAgent (versions up to 2.1.3) is vulnerable to a remote denial of service in the BrowserTool function within agent/tools/browser/browser_tool.py (the Browser Tool component). An attacker with low privileges can trigger the DoS remotely with low complexity and no user interaction. A pro...

CVE-2026-84924

CVE-2026-84924 has been reserved by an organization or individual and no technical details (affected product, root cause, or impact) are publicly available yet. Monitor for updates as the candidate is expected to be publicized with full details.

CVE-2026-73437

Arista EOS with DHCP relay configured is vulnerable to insufficient verification of data authenticity (CWE-345). An unauthenticated attacker with network access can send crafted DHCP reply packets from an unconfigured source IP address, which the relay agent forwards without validation. This allo...

CVE-2026-75945

CVE-2026-75945 is a race condition in Arista EOS 4.36.1F where a supplicant may remain in an authorized state after the clear dot1x host all command is issued, classified as CWE-459 (Incomplete Cleanup) . The vulnerability requires 802.1X configured in authenticator mode with ACL-based authorizat...

CVE-2026-86106

Arista VeloCloud Edge is affected by a missing authentication vulnerability (CWE-306) on the private HA (High Availability) interconnect. An unauthenticated actor with Layer 2 access to the HA interconnect can trigger sensitive HA peer functions, potentially resulting in elevated command executio...

CVE-2026-19655

Arista EOS is vulnerable to a DHCP Relay/Snooping service restart via improper input validation (CWE-20) when DHCP is configured with the information option (Option 82) . An unauthenticated attacker connected to a client-facing VLAN can send a specially crafted packet that causes the DhcpRelay pr...