CVE-2026-75592

Kirby (open-source CMS) contained an incomplete filesystem containment flaw in its media handler prior to 4.9.5 and 5.5.2 . The Dir::realpath() and F::realpath() functions accepted a sibling directory sharing the intended root's string prefix (e.g., /var/www/site2 next to /var/www/site) without e...

CVE-2026-61640

Wallos , an open-source self-hostable personal subscription tracker, is affected by an SSRF vulnerability prior to version 4.9.6. The root cause is in includes/oidc/handle_oidc_callback.php (lines 18–49), where Admin-configured OIDC token_url and user_info_url values are passed directly to curl_i...

CVE-2026-83596

CVE-2026-83596 is a memory corruption vulnerability in WebKitGTK caused by improper handling of the featurelist array in the OpenTypeVerticalData::findFeature function. Processing malicious web content can trigger the flaw, leading to memory corruption with high impact on confidentiality, integri...

CVE-2026-71415

Kirby CMS (versions 5.0.0–5.5.2) contains a flaw in its REST API chunk upload handler (src/Api/Upload.php). The method Kirby\Api\Upload::process() failed to execute the relevant upload authorization preflight before processChunk() persisted chunk data. An authenticated user holding the access.pan...

CVE-2026-82914

kishan0725 Hospital-Management-System 1.0 contains a SQL injection vulnerability in the file /search.php , triggered by manipulation of the Contact argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL queries, resulting in low impact on confidentiality, integrity,...

CVE-2026-61639

Wallos , an open-source self-hostable personal subscription tracker, contains a Zip Slip path traversal in POST /endpoints/db/restore.php prior to version 4.9.6 . The endpoint calls ZipArchive::extractTo() without validating entry names for ../ sequences. An authenticated admin can upload a craft...

CVE-2026-81779

CVE-2026-81779 is a backdoor vulnerability in the Silk Themes Newspapers X WordPress theme, discovered by ashv4ni and reported via Patchstack . It affects versions 1.0.46 through 1.0.48 and is classified as Improper Validation of Specified Quantity in Input , allowing malicious software to be imp...

CVE-2026-61638

CVE-2026-61638 affects Wallos , an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6 , the endpoint POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from the request body with no SSRF validation , allowing PHPMailer to connec...

CVE-2026-81278

WPExperts Post SMTP WordPress plugin is affected by a Missing Authorization (Settings Change) vulnerability in versions 4.0.0 through 4.0.0-beta.1 . The flaw allows low-privileged users to exploit incorrectly configured access control levels, resulting in low integrity and availability impact wit...

CVE-2026-81892

EasyAdmin for Symfony (versions 4.0.0 through 4.29.16 and 5.5.1) contains a security bypass in its custom-action dispatcher. When Action::linkToRoute() or MenuItem::linkToRoute() is used, the executed controller is swapped via the routeName query parameter on the kernel.controller event — after S...

CVE-2026-82346

A potential privilege escalation vulnerability was identified in HP ImageDiags , affecting versions prior to 5.0.0.36 . The root cause is insufficient access controls , which could allow a local attacker with low privileges and active user interaction to escalate to higher system access. The assi...

CVE-2026-81891

elFinder (open-source web file manager) is vulnerable to remote code execution prior to version 2.1.70 . The flaw resides in checkExtractItems() in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, ...

CVE-2026-54600

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4 , the endpoints/db/import.php endpoint lacks authentication. The only protective guard is a check on the user-table row count: if the count is zero (as in a fresh or unconfigured install ), an unauthenti...

CVE-2026-82229

An unauthenticated Cross Site Scripting (XSS) vulnerability affects the WordPress Social Login and Register plugin in versions 7.8.2 and earlier . The flaw was discovered by Patchstack researcher Ananda Dhakal and carries a CVSS 3.1 score of 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L...

CVE-2026-82228

SiteGround Security WordPress plugin versions ≤ 1.6.6 are affected by an unauthenticated 2FA Bypass vulnerability, discovered by Ananda Dhakal via Patchstack. The flaw allows a network-based attacker (with high attack complexity, no prior privileges or user interaction) to bypass two-factor authe...

CVE-2026-82226

This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...

CVE-2026-82225

RegistrationMagic (Custom Registration Form Builder with Submission Manager) WordPress plugin versions ≤ 6.0.9.8 are affected by an unauthenticated Broken Authentication vulnerability, discovered by Emiliano Carrizo. The CVSS v3.1 score is 7.4 (HIGH) with a network attack vector, high complexity,...

CVE-2026-82224

CVE-2026-82224 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress SliceWP plugin , affecting versions

CVE-2026-81780

Hash Form is a WordPress plugin affected by an unauthenticated arbitrary file upload vulnerability in versions

CVE-2026-82221

CVE-2026-82221 affects the RegistrationMagic WordPress plugin (a custom registration form builder with submission manager) in versions ≤ 6.0.9.8 . The vulnerability is an unauthenticated Cross Site Scripting (XSS) , rated CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, ...

CVE-2026-81778

CVE-2026-81778 affects the Kalles Addons WordPress plugin in versions 1.0.6 and earlier . The vulnerability is a Cross Site Scripting (XSS) flaw in the plugin's Subscriber functionality. The CVSS v3.1 score is 6.5 (MEDIUM) with a Changed Scope vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L)...

CVE-2026-81768

CVE-2026-81768 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Super Store Finder , affecting versions

CVE-2026-81765

CVE-2026-81765 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Tailored Tools , affecting versions 3.0.2 and earlier . The vulnerability was discovered by V1T and is rated HIGH (CVSS 3.1: 7.1) , with a network attack vector, low complexity, no privileges req...

CVE-2026-81763

CVE-2026-81763 is an unauthenticated SQL injection vulnerability in the WordPress plugin Throws SPAM Away (versions ≤ 3.8.2 ), discovered by Jiemook . The flaw allows a network-based attacker with no privileges to inject SQL queries, leading to a High impact on confidentiality and a Low impact on...

CVE-2026-81764

CVE-2026-81764 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Email Essentials plugin, affecting versions 6.0.6 and earlier . Discovered by JunHee CHO , the flaw allows an attacker to inject script via the network with low complexity and no prior privileges , thou...

CVE-2026-81762

CVE-2026-81762 is a Broken Access Control vulnerability in the Booking and Rental Manager WordPress plugin (for WooCommerce), affecting versions 2.7.6 and earlier . The flaw allows users with the Subscriber role to perform actions they should not be permitted to, resulting in a High integrity imp...

CVE-2026-81756

An unauthenticated SQL injection vulnerability exists in the WordPress plugin Smart Marketing SMS and Newsletters Forms in versions

CVE-2026-81758

CVE-2026-81758 is a Broken Access Control vulnerability in the WordPress plugin OwnerRez API , affecting versions ≤ 1.2.6 . The flaw allows users with the Subscriber role to perform actions they should not be authorized for, as discovered by JunHee CHO via PatchStack. The CNA-assigned CVSS 3.1 sc...

CVE-2026-81298

Unauthenticated Cross-Site Scripting (XSS) was identified in the WordPress LeadConnector plugin, affecting versions 4.0.5 and earlier . The vulnerability, discovered by daroo , allows an unauthenticated attacker to execute arbitrary scripts in a victim's browser context, with a CVSS 3.1 score of ...

CVE-2026-81297

Fluent Forms Pro Add On Pack is a WordPress plugin affected by a Subscriber Privilege Escalation vulnerability in versions ≤ 6.2.12 , as discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 7.5 (HIGH) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-based attac...

CVE-2026-81296

CVE-2026-81296 affects the WordPress plugin Fluent Forms Pro Add On Pack (versions

CVE-2026-81293

CVE-2026-81293 is an unauthenticated SQL injection vulnerability in the WP Data Access WordPress plugin, affecting versions 5.5.81 and below . The flaw was discovered by sequence_X0 and reported via Patchstack. The CVSS v3.1 score is 9.3 (Critical) , with a network attack vector, low complexity, ...

CVE-2026-81290

CVE-2026-81290 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Email Subscribers & Newsletters , affecting versions ≤ 5.9.33 . The vulnerability was discovered by Jiemook and rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicat...

CVE-2026-81291

CVE-2026-81291 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Uncode theme , affecting versions ≤ 2.12.7 . The vulnerability was discovered by Nguyen Ba Khanh of HPT Vietnam Corporation. With a CVSS 3.1 score of 7.1 (HIGH) , it has a network attack vector , low co...

CVE-2026-81287

CVE-2026-81287 affects the WordPress Charitable plugin in versions 1.8.12.1 and earlier , where a subscriber-level SQL injection vulnerability exists. The flaw allows an authenticated subscriber to exploit a SQL injection, with a CVSS 3.1 score of 8.5 (HIGH) . The vector CVSS:3.1/AV:N/AC:L/PR:L/U...

CVE-2026-81280

Print Barcode Labels for your WooCommerce products/orders is a WordPress plugin vulnerable to Sensitive Data Exposure in versions 4.0.0 and below . The vulnerability requires Subscriber-level privileges (low) and can be exploited over the network with low complexity and no user interaction, resul...

CVE-2026-82852

CVE-2026-82852 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the WordPress MapSVG plugin (Interactive Vector Maps), affecting versions 8.15.0 and earlier . The vulnerability is rated CVSS 5.4 (MEDIUM) with a vector of AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating net...

CVE-2026-54599

Wallos , an open-source self-hostable personal subscription tracker, is vulnerable to login CSRF / account takeover prior to version 4.9.4 . The root cause is that login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without ...

CVE-2026-82909

QuantumNous new-api versions up to 1.0.0-rc.15 are affected by a vulnerability in the Revoked API Token Handler (file /api/usage/token/). Manipulation of an unknown function in this component can lead to session expiration . The attack is remote and requires low privileges , with a low confidenti...

CVE-2026-81890

elFinder (an open-source web file manager built on jQuery UI) prior to 2.1.70 is vulnerable to a CSRF flaw in the netmount command. The command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is never invoked for this state-changing...

CVE-2026-54598

Wallos , an open-source self-hostable personal subscription tracker, is affected by a missing authentication flaw in endpoints/db/migrate.php. Prior to version 4.9.4 , this endpoint executes database schema migrations over HTTP with zero authentication , allowing any unauthenticated attacker to t...

CVE-2026-81888

@hono/oauth-providers , authentication middleware for the Hono web framework, has a flaw in its OAuth state validation. Prior to version 0.8.6 , the built-in social login providers accept an OAuth callback even when the state value is absent on both the expected and received sides, causing the an...

CVE-2026-50199

Wallos , an open-source self-hostable personal subscription tracker, is affected in versions prior to 4.9.1 . The vulnerable component is endpoints/currency/update_exchange.php, which loads the first Fixer/API Layer credential globally rather than the credential belonging to the authenticated use...

CVE-2026-81889

elFinder (open-source web file manager) contains an SSRF protection bypass in php/elFinder.class.php prior to version 2.1.70 . When PHP cURL is unavailable, get_remote_contents() falls back to fsock_get_contents(), which performs a second DNS resolution to $arr['host'] independent of the IP alrea...

CVE-2026-50198

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1 , an authenticated user could edit their own inactive subscription and set the replacement_subscription_id field to a subscription ID belonging to another user. The write was accepted, and the stats logi...

CVE-2026-82908

MSI Dragon Center up to version 2.0.155.0 contains an integer overflow in the function MmioWritePath within the driver NTIOLib_X64.sys (component: MMIO Write Path Handler). The overflow is triggered by manipulating the argument count or elementSize parameters. Exploitation requires a local attack...

CVE-2026-81887

Livewire (a full-stack framework for Laravel) is affected by a DOM-based XSS in versions 3.0.0-beta.1 through 3.8.3 and 4.3.4. The root cause lies in the dot-notated query-string parser in js/plugins/history/index.js (functions fromQueryString() and insertDotNotatedValueIntoData()), which accepts...

CVE-2026-54179

CVE-2026-54179 affects backpack/crud , a Laravel package for building admin panels. The SingleBase64Image uploader, bound to image-typed fields via withFiles(), accepts any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes. A related flaw in FileName...

CVE-2026-82906

A missing authentication flaw in sdcb chats versions up to 1.12.0 affects the Signed File Download Endpoint , specifically the DownloadPublic function in src/BE/web/Controllers/Chats/Files/FileController.cs. An unauthenticated remote attacker with high complexity can exploit this to achieve low c...

CVE-2026-82905

A server-side request forgery (SSRF) vulnerability exists in sdcb chats versions up to 1.12.0 , specifically in the McpController function within the fetch-tools endpoint (file: src/BE/web/Controllers/Users/Mcps/McpController.cs). The vulnerability is exploitable remotely with low complexity and ...