CVE-2026-13203

CVE-2026-13203 is a Stored Cross-Site Scripting (XSS) vulnerability in the Live Composer – Free WordPress Website Builder plugin, affecting versions up to 2.1.19 . The root cause is insufficient sanitization and output escaping of the custom_id shortcode attribute in the dslc_modules_section and ...

CVE-2026-16787

The Live Composer – Free WordPress Website Builder plugin (versions up to and including 2.1.19 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the dslc_custom_field shortcode, caused by insufficient input sanitization and output escaping . Authenticated attackers with contributor-level a...

CVE-2026-19952

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.12 ) is vulnerable to unauthenticated arbitrary file deletion caused by insufficient file path validation in the move_folders function, specifically via the custom_directory_name Merge Tag. Discovered by nudien , the flaw allows a...

CVE-2026-75965

The User Profile Builder WordPress plugin (versions ≤ 4.0.0 ) is vulnerable to Stored Cross-Site Scripting via the 'date' Shortcode Attribute , caused by insufficient input sanitization and output escaping in the format-date shortcode. Authenticated users with contributor-level access or higher c...

CVE-2026-76006

Photo Gallery by Ays (WordPress plugin) versions up to and including 6.8.2 are vulnerable to SQL Injection via the 's' parameter . The root cause is insufficient escaping and lack of query preparation on user-supplied input across two execution paths: $wpdb->get_var() in record_count() and $wp...

CVE-2026-19806

The Support Genix WordPress plugin (≤ 1.4.52 ) is vulnerable to Authentication Bypass leading to Administrator Account Takeover via its guest_ticket_login() function and the publicly reachable /sgnix/?p= endpoint. The root cause is a weak site-wide AES-256-CBC encryption key derived from three tw...

CVE-2026-17589

The Shopping Cart & eCommerce Store (WP EasyCart) plugin for WordPress is vulnerable to a second-order SQL injection via the product_order parameter in versions up to 5.9.2 . The payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler with no sanitization on raw $_...

CVE-2026-18752

CVE-2026-18752 affects the Persistent Login plugin for WordPress in all versions up to and including 3.1.0 . The vulnerability is a generic SQL injection via the wppl_device_id cookie, caused by insufficient escaping of the user-supplied parameter and lack of proper query preparation. Authenticat...

CVE-2026-75921

The Master Addons for Elementor WordPress plugin is vulnerable to an authenticated arbitrary file upload in all versions up to and including 3.1.9 . The root cause lies in the upload_template_kit() AJAX handler, which incorrectly requires only the upload_files capability instead of the manage_opt...

CVE-2026-19796

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lsd[displ][style] parameter in all versions up to and including 5.8.1 . The root cause is insufficient input sanitization and output escaping , allowi...

CVE-2026-82747

CVE-2026-82747 is an Incorrect Authorization vulnerability in ash-project ash (Elixir API framework), affecting versions 3.4.44 through 3.32.1 . The bug resides in Ash.Policy.Authorizer (lib/ash/policy/authorizer/authorizer.ex): when a resource uses an access_type: :runtime read policy, the check...

CVE-2026-82749

CVE-2026-82749 is an Incorrect Authorization flaw in ash-project ash (versions 3.13.2 through 3.32.1 ). The vulnerable component is resolve_parent_in_filter/3 in lib/ash/actions/read/relationships.ex, which resolved unresolvable parent(...) references to nil instead of raising an error. This caus...

CVE-2026-82748

An incorrect authorization flaw in the Elixir library ash-project ash (versions 3.5.13 through before 3.32.2 ) affects Ash.Actions.Aggregate . Aggregates are authorized under a group's read_action, but the query-building code selected the action as opts[:action] || read_action || primary_read. Wh...

CVE-2026-82746

CVE-2026-82746 is a missing authorization flaw in the ash-project/ash Elixir framework affecting versions 3.29.0 through 3.32.1 . The Ash.update_many/4 function, when using the atomic strategy, executed a single data-layer statement (e.g., a SQL MERGE) that bypassed resource policies even with au...

CVE-2026-82745

ash (an Elixir data-layer framework) is vulnerable to improper access control in its ETS and Mnesia data layers. Unlike the SQL data layer, these layers implemented create as a keyed insert that silently replaces any existing entry sharing the same primary key, rather than enforcing uniqueness. A...

CVE-2026-82744

ash-project ash (Elixir library) contains a Failing Open vulnerability in Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex). When a where guard controlling a change step raises an exception (e.g., on attacker-influenced input), the rescue in apply_validation converts it to {:error, er...

CVE-2026-82743

ash-project ash (Elixir framework) contains an uncontrolled resource consumption vulnerability in Ash.Actions.Read.AsyncLimiter.await_at_least_one/1. The function polled outstanding async read tasks with Task.yield(task, 0) in a tight loop rather than blocking, causing a BEAM scheduler to spin at...

CVE-2026-82742

CVE-2026-82742 is an uncontrolled resource consumption vulnerability in the ash Elixir framework (versions 1.29.0-rc0 through before 3.32.2 ). The root cause is in Ash.Filter.Runtime's flatten_relationships/2 function (lib/ash/filter/runtime.ex), which eagerly materializes the full Cartesian prod...

CVE-2026-82741

CVE-2026-82741 affects the ash-project ash Elixir framework (versions 2.14.18 through before 3.32.2 ). The vulnerability is in Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex), which did not force the configured tag when writing values with storage: :map_with_tag. An attacker can submit a ...

CVE-2026-82740

ash-project ash (versions 2.16.1 through before 3.32.2 ) contains an improper input validation flaw in Ash.Type.apply_constraints/3 (lib/ash/type/type.ex). When handling a doubly-nested {:array, {:array, type}} attribute, only the inner array constraints were mapped over each element, so outer ar...

CVE-2026-82739

CVE-2026-82739 is a Generation of Error Message Containing Sensitive Information vulnerability in the ash-project ash Elixir framework, specifically in Ash.Resource.Validation.Confirm's atomic implementation. When an actor supplies only a confirmation argument (without the field itself), the mism...

CVE-2026-82738

An Improper Input Validation flaw in ash-project ash (Elixir framework) allows an attacker to permanently poison a database record. The Ash.Type.UUIDv7 type's cast_input/2 accepts any well-formed UUID string and stores it as a 16-byte binary. However, on read, cast_stored/2 routes the binary back...

CVE-2026-82737

CVE-2026-82737 is an integer overflow in Ash.Vector.new/1 (lib/ash/vector.ex) in the ash-project ash Elixir library. The dimension field is packed into a 16-bit unsigned integer without a range check, so a vector with more than 65,535 elements wraps modulo 65,536, producing a header that disagree...

CVE-2026-82736

ash-project ash (Elixir web framework) contains an Incorrect Behavior Order: Validate Before Canonicalize vulnerability in Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex). The max_length , min_length , and match constraints were validated against the value as submitted , while t...

CVE-2026-82735

ash-project ash (Elixir library) is affected by an uncontrolled resource consumption vulnerability in Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex). The :match regex was evaluated regardless of min_length/max_length constraints, so over-length input that should have been rejected b...

CVE-2026-19032

CVE-2026-19032 affects jackson-databind , where the java.nio.file.Path deserializer (JDKFromStringDeserializer.NioPathHelper.deserialize) resolves an attacker-supplied URI without restricting its scheme. When Path.of(uri) throws FileSystemNotFoundException, the code enumerates ServiceLoader and c...

CVE-2026-82734

CVE-2026-82734 affects ash-project ash (Elixir), versions 1.28.0 through 3.32.1 . The vulnerability is in Ash.Type.Decimal (lib/ash/type/decimal.ex), which casts input via Ecto's decimal cast without verifying the result is finite. Because Elixir's Decimal module treats Infinity and NaN as valid ...

CVE-2026-75865

WPLP Cookie Consent (a WordPress plugin for GDPR/CCPA consent management) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.4.1 . The root cause combines missing file type validation in the saas_upload_logo() function with an authorization bypass on the ...

CVE-2026-82731

ash_typescript (from ash-project) is vulnerable to an open redirect in its generated TypeScript client. The root cause lies in lib/ash_typescript/typed_controller/codegen/route_renderer.ex, where :param placeholders are interpolated without calling encodeURIComponent . An attacker who controls a ...

CVE-2026-74837

CVE-2026-74837 is an unauthenticated denial-of-service vulnerability in ash-project ash_typescript (versions 0.1.0 before 0.18.0 ). The root cause lies in AshTypescript.FieldFormatter.convert_to_field_atom/2, which mints a permanent BEAM atom for every client-supplied RPC field name via String.to...

CVE-2026-82733

ash_typescript (ash-project) is vulnerable to Generation of Error Message Containing Sensitive Information in its typed-controller. When a route handler returns anything other than a %Plug.Conn{}, the dispatch/3 function in request_handler.ex passes the value to unexpected_return/2, which interpo...

CVE-2026-82732

ash_typescript (versions 0.15.0 through before 0.18.0) contains an improper input validation flaw in AshTypescript.TypedController.RequestHandler. The handler calls Ash.Type.cast_input/3 to coerce input but never invokes Ash.Type.apply_constraints/3, rendering declared constraints (one_of, max_le...

CVE-2026-82730

ash_typescript (v0.11.0

CVE-2026-77950

ash_typescript (versions 0.8.0 through before 0.18.0) contains a fail-open flaw in its RPC error handling. The apply_error_handler/3 function in lib/ash_typescript/rpc/errors.ex is the sole hook for redacting or suppressing errors before they reach the client. Because error handlers are conventio...

CVE-2026-77856

ash_typescript (Elixir/BEAM library by ash-project) contains a resource-exhaustion flaw in resolve_typed_struct_field/2 within field_selector.ex. When a client-supplied field name on a typed struct field has no match in the reverse map, the code falls back to String.to_atom/1 before any field-exi...

CVE-2026-48932

A flaw in the Node.js HTTP client can cause request desynchronization in Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. The root cause is that Node.js may omit headers beyond maxHea...

CVE-2026-65643

cPanel & WHM versions prior to 11.138.0.2 (and older branches 11.110, 11.134, 11.136) contain an eval injection in the domain parking and addon domain functionality. An authenticated user with permission to add parked or addon domains can create arbitrary files on the server, escalating to code e...

CVE-2026-67394

Plesk for Linux versions 18.0.34 through before 18.0.79.9 and 18.0.80.5 are affected by a critical local privilege escalation via OS command injection (CVSS 4.0: 9.0). An attacker who already has shell access (or is allowed to change their own shell) can escalate to the root account on the hostin...

CVE-2026-67395

A path traversal vulnerability in Sage Employee Self Service (part of Sage HRMS) arises from improper validation of file path parameters in the custom logo functionality. An unauthenticated remote attacker can leverage directory traversal sequences and their encoded variants to bypass directory r...

CVE-2026-18743

popt (specifically the poptConfigFileToString function in popt-static/popt-devel) contains a short realloc bug that can cause heap metadata corruption when a host loads specially crafted configuration content. Successful exploitation results in a low-impact denial of service due to process unavai...

CVE-2026-19820

CVE-2026-19820 affects the Backblaze Client for Windows . The root cause is improper link resolution : a local user can create a link from Backblaze's folder to Windows OS system files during a backup, potentially rendering the system not bootable . Successful exploitation requires an administrat...

CVE-2026-57582

CVE-2026-57582 affects GeoNetwork , a geographic metadata management platform. The root cause is a single missing annotation that leaves critical GeoNetwork infrastructure exposed. According to PT Security research, the vulnerability group (alongside CVE-2026-63219, CVE-2026-55864, and CVE-2026-5...

CVE-2026-51974

CVE-2026-51974 is an eval() injection vulnerability in the get_list function of modules/meta_parser.py in lllyasviel Fooocus versions 2.1.854 through 2.5.5 . A remote attacker with low privileges can craft a "styles" payload in the EXIF metadata of an uploaded image file, causing the application ...

CVE-2026-51748

CVE-2026-51748 is an incorrect access control vulnerability in the sendStaticInfoToMaster function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to update stored slave inventory records, achieving a h...

CVE-2026-52111

CVE-2026-52111 affects fast-note-sync-service versions ≤ 2.13.7 . The root cause is that the admin configuration endpoint exposes the authTokenKey , enabling a remote attacker with no prior privileges to escalate their access. The vulnerability is scored CVSS 9.8 (Critical) with a network attack ...

CVE-2026-51766

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the setDevReboot function. An unauthenticated, network-based attacker can send a crafted MQTT message to the cs_broker component to reboot the device. On a mesh master , the reboot command fans out to all me...

CVE-2026-51934

CVE-2026-51934 is a buffer overflow in the Tenda A18 router (Shenzhen Jixiang Tengda Technology Co., Ltd.) version v.15.13.07.09 , located in the fromSetCmdlineRun function. A remote, unauthenticated attacker can exploit this to achieve arbitrary code execution over the network, rated CVSS 9.8 (C...

CVE-2026-51762

TOTOLINK T6 version 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the meshInfoKick function. An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to kick or clean stale mesh information/state and trigger regeneration of mesh metadata. T...

CVE-2026-51744

CVE-2026-51744 is an incorrect access control flaw in the recv_mesh_info_sync function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015). An unauthenticated remote attacker can send a crafted MQTT message to the cs_broker component to force mesh configuration synchronization from an attacker-contro...

CVE-2026-51743

CVE-2026-51743 is an incorrect access control vulnerability in the guest_wifi_sync function of the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted MQTT message to the cs_broker component to disable guest virtual AP interfaces. The vulnera...