CVE-2026-75980

CVE-2026-75980 is a Stored Cross-Site Scripting (XSS) vulnerability in the BetterDocs WordPress plugin (versions ≤ 4.8.1), discovered by Wordfence PRISM . The flaw resides in the Heading 'id' attribute within post content: entity-encoded quotes bypass wp_kses_post at save time, and the payload ma...

CVE-2026-75964

CVE-2026-75964 affects the User Profile Builder WordPress plugin in all versions up to and including 4.0.0 . The vulnerability is a Stored Cross-Site Scripting (XSS) in the 'email' parameter of the email-confirmation feature, caused by insufficient input sanitization and output escaping. An unaut...

CVE-2026-83772

Cobham SATCOM VSAT7090 Maritime Satellite Router versions up to 20260704 are affected by a command injection vulnerability in the JSON Parsing component. The root cause lies in the function c_set_reports_decode within the file mail-report.sh , where unsanitized manipulation of the sender/recipien...

CVE-2026-77189

The Charitable WordPress plugin (Donation & Fundraising Platform) is vulnerable to SQL Injection via the 'order' attribute of the [charitable_donors] shortcode in all versions up to and including 1.8.12.1 . The root cause is insufficient escaping of the user-supplied parameter combined with a lac...

CVE-2026-83744

Invoice Ninja up to 5.13.26 is affected by a Server-Side Request Forgery (SSRF) in the invoices Endpoint , specifically in the function Purify::isHostSafe within app/Services/Pdf/Purify.php. Manipulating the notes argument allows a remote, low-privileged attacker to forge server-side requests. Th...

CVE-2026-83743

Invoice Ninja versions up to 5.13.26 are affected by an authorization bypass in the Vendor Portal Profile Update component (file /vendor/profile/). By manipulating the vendor_contact argument, a remotely authenticated user (low privileges) can bypass access controls, resulting in low impact on co...

CVE-2026-19948

The Cozy Blocks WordPress plugin (all versions up to and including 2.2.17 ) is vulnerable to authorization bypass . Multiple block renderers unconditionally emit the sidebarNonce value into public page HTML with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass th...

CVE-2026-12747

The Frontend Admin by DynamiApps plugin for WordPress (versions ≤ 3.29.11) is affected by an authenticated Stored Cross-Site Scripting vulnerability via the 'tag' Shortcode Attribute , caused by insufficient input sanitization and output escaping. Attackers with contributor-level access or higher...

CVE-2026-77823

The LearnPress WordPress plugin (versions ≤ 4.4.4 ) is vulnerable to SQL injection via the orderby parameter in the export_order_csv AJAX action. The root cause is insufficient escaping: only the literal values date and title are normalized, while any other attacker-controlled string is concatena...

CVE-2026-19573

The Affiliate Super Assistent WordPress plugin (all versions up to and including 1.10.2 ) is affected by a Stored Cross-Site Scripting vulnerability in the doCommentShortcode function, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary we...

CVE-2026-13203

CVE-2026-13203 is a Stored Cross-Site Scripting (XSS) vulnerability in the Live Composer – Free WordPress Website Builder plugin, affecting versions up to 2.1.19 . The root cause is insufficient sanitization and output escaping of the custom_id shortcode attribute in the dslc_modules_section and ...

CVE-2026-16787

The Live Composer – Free WordPress Website Builder plugin (versions up to and including 2.1.19 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the dslc_custom_field shortcode, caused by insufficient input sanitization and output escaping . Authenticated attackers with contributor-level a...

CVE-2026-19952

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.12 ) is vulnerable to unauthenticated arbitrary file deletion caused by insufficient file path validation in the move_folders function, specifically via the custom_directory_name Merge Tag. Discovered by nudien , the flaw allows a...

CVE-2026-75965

The User Profile Builder WordPress plugin (versions ≤ 4.0.0 ) is vulnerable to Stored Cross-Site Scripting via the 'date' Shortcode Attribute , caused by insufficient input sanitization and output escaping in the format-date shortcode. Authenticated users with contributor-level access or higher c...

CVE-2026-76006

Photo Gallery by Ays (WordPress plugin) versions up to and including 6.8.2 are vulnerable to SQL Injection via the 's' parameter . The root cause is insufficient escaping and lack of query preparation on user-supplied input across two execution paths: $wpdb->get_var() in record_count() and $wp...

CVE-2026-19806

The Support Genix WordPress plugin (≤ 1.4.52 ) is vulnerable to Authentication Bypass leading to Administrator Account Takeover via its guest_ticket_login() function and the publicly reachable /sgnix/?p= endpoint. The root cause is a weak site-wide AES-256-CBC encryption key derived from three tw...

CVE-2026-17589

The Shopping Cart & eCommerce Store (WP EasyCart) plugin for WordPress is vulnerable to a second-order SQL injection via the product_order parameter in versions up to 5.9.2 . The payload is written to the ec_pageoption table via the ec_ajax_save_page_options handler with no sanitization on raw $_...

CVE-2026-18752

CVE-2026-18752 affects the Persistent Login plugin for WordPress in all versions up to and including 3.1.0 . The vulnerability is a generic SQL injection via the wppl_device_id cookie, caused by insufficient escaping of the user-supplied parameter and lack of proper query preparation. Authenticat...

CVE-2026-75921

The Master Addons for Elementor WordPress plugin is vulnerable to an authenticated arbitrary file upload in all versions up to and including 3.1.9 . The root cause lies in the upload_template_kit() AJAX handler, which incorrectly requires only the upload_files capability instead of the manage_opt...

CVE-2026-19796

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lsd[displ][style] parameter in all versions up to and including 5.8.1 . The root cause is insufficient input sanitization and output escaping , allowi...

CVE-2026-82747

CVE-2026-82747 is an Incorrect Authorization vulnerability in ash-project ash (Elixir API framework), affecting versions 3.4.44 through 3.32.1 . The bug resides in Ash.Policy.Authorizer (lib/ash/policy/authorizer/authorizer.ex): when a resource uses an access_type: :runtime read policy, the check...

CVE-2026-82749

CVE-2026-82749 is an Incorrect Authorization flaw in ash-project ash (versions 3.13.2 through 3.32.1 ). The vulnerable component is resolve_parent_in_filter/3 in lib/ash/actions/read/relationships.ex, which resolved unresolvable parent(...) references to nil instead of raising an error. This caus...

CVE-2026-82748

An incorrect authorization flaw in the Elixir library ash-project ash (versions 3.5.13 through before 3.32.2 ) affects Ash.Actions.Aggregate . Aggregates are authorized under a group's read_action, but the query-building code selected the action as opts[:action] || read_action || primary_read. Wh...

CVE-2026-82746

CVE-2026-82746 is a missing authorization flaw in the ash-project/ash Elixir framework affecting versions 3.29.0 through 3.32.1 . The Ash.update_many/4 function, when using the atomic strategy, executed a single data-layer statement (e.g., a SQL MERGE) that bypassed resource policies even with au...

CVE-2026-82745

ash (an Elixir data-layer framework) is vulnerable to improper access control in its ETS and Mnesia data layers. Unlike the SQL data layer, these layers implemented create as a keyed insert that silently replaces any existing entry sharing the same primary key, rather than enforcing uniqueness. A...

CVE-2026-82744

ash-project ash (Elixir library) contains a Failing Open vulnerability in Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex). When a where guard controlling a change step raises an exception (e.g., on attacker-influenced input), the rescue in apply_validation converts it to {:error, er...

CVE-2026-82743

ash-project ash (Elixir framework) contains an uncontrolled resource consumption vulnerability in Ash.Actions.Read.AsyncLimiter.await_at_least_one/1. The function polled outstanding async read tasks with Task.yield(task, 0) in a tight loop rather than blocking, causing a BEAM scheduler to spin at...

CVE-2026-82742

CVE-2026-82742 is an uncontrolled resource consumption vulnerability in the ash Elixir framework (versions 1.29.0-rc0 through before 3.32.2 ). The root cause is in Ash.Filter.Runtime's flatten_relationships/2 function (lib/ash/filter/runtime.ex), which eagerly materializes the full Cartesian prod...

CVE-2026-82741

CVE-2026-82741 affects the ash-project ash Elixir framework (versions 2.14.18 through before 3.32.2 ). The vulnerability is in Ash.Type.Union.dump_to_native/2 (lib/ash/type/union.ex), which did not force the configured tag when writing values with storage: :map_with_tag. An attacker can submit a ...

CVE-2026-82740

ash-project ash (versions 2.16.1 through before 3.32.2 ) contains an improper input validation flaw in Ash.Type.apply_constraints/3 (lib/ash/type/type.ex). When handling a doubly-nested {:array, {:array, type}} attribute, only the inner array constraints were mapped over each element, so outer ar...

CVE-2026-82739

CVE-2026-82739 is a Generation of Error Message Containing Sensitive Information vulnerability in the ash-project ash Elixir framework, specifically in Ash.Resource.Validation.Confirm's atomic implementation. When an actor supplies only a confirmation argument (without the field itself), the mism...

CVE-2026-82738

An Improper Input Validation flaw in ash-project ash (Elixir framework) allows an attacker to permanently poison a database record. The Ash.Type.UUIDv7 type's cast_input/2 accepts any well-formed UUID string and stores it as a 16-byte binary. However, on read, cast_stored/2 routes the binary back...

CVE-2026-82737

CVE-2026-82737 is an integer overflow in Ash.Vector.new/1 (lib/ash/vector.ex) in the ash-project ash Elixir library. The dimension field is packed into a 16-bit unsigned integer without a range check, so a vector with more than 65,535 elements wraps modulo 65,536, producing a header that disagree...

CVE-2026-82736

ash-project ash (Elixir web framework) contains an Incorrect Behavior Order: Validate Before Canonicalize vulnerability in Ash.Type.CiString.apply_constraints/2 (lib/ash/type/ci_string.ex). The max_length , min_length , and match constraints were validated against the value as submitted , while t...

CVE-2026-82735

ash-project ash (Elixir library) is affected by an uncontrolled resource consumption vulnerability in Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex). The :match regex was evaluated regardless of min_length/max_length constraints, so over-length input that should have been rejected b...

CVE-2026-19032

CVE-2026-19032 affects jackson-databind , where the java.nio.file.Path deserializer (JDKFromStringDeserializer.NioPathHelper.deserialize) resolves an attacker-supplied URI without restricting its scheme. When Path.of(uri) throws FileSystemNotFoundException, the code enumerates ServiceLoader and c...

CVE-2026-82734

CVE-2026-82734 affects ash-project ash (Elixir), versions 1.28.0 through 3.32.1 . The vulnerability is in Ash.Type.Decimal (lib/ash/type/decimal.ex), which casts input via Ecto's decimal cast without verifying the result is finite. Because Elixir's Decimal module treats Infinity and NaN as valid ...

CVE-2026-75865

WPLP Cookie Consent (a WordPress plugin for GDPR/CCPA consent management) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.4.1 . The root cause combines missing file type validation in the saas_upload_logo() function with an authorization bypass on the ...

CVE-2026-82731

ash_typescript (from ash-project) is vulnerable to an open redirect in its generated TypeScript client. The root cause lies in lib/ash_typescript/typed_controller/codegen/route_renderer.ex, where :param placeholders are interpolated without calling encodeURIComponent . An attacker who controls a ...

CVE-2026-74837

CVE-2026-74837 is an unauthenticated denial-of-service vulnerability in ash-project ash_typescript (versions 0.1.0 before 0.18.0 ). The root cause lies in AshTypescript.FieldFormatter.convert_to_field_atom/2, which mints a permanent BEAM atom for every client-supplied RPC field name via String.to...

CVE-2026-82733

ash_typescript (ash-project) is vulnerable to Generation of Error Message Containing Sensitive Information in its typed-controller. When a route handler returns anything other than a %Plug.Conn{}, the dispatch/3 function in request_handler.ex passes the value to unexpected_return/2, which interpo...

CVE-2026-82732

ash_typescript (versions 0.15.0 through before 0.18.0) contains an improper input validation flaw in AshTypescript.TypedController.RequestHandler. The handler calls Ash.Type.cast_input/3 to coerce input but never invokes Ash.Type.apply_constraints/3, rendering declared constraints (one_of, max_le...

CVE-2026-82730

ash_typescript (v0.11.0

CVE-2026-77950

ash_typescript (versions 0.8.0 through before 0.18.0) contains a fail-open flaw in its RPC error handling. The apply_error_handler/3 function in lib/ash_typescript/rpc/errors.ex is the sole hook for redacting or suppressing errors before they reach the client. Because error handlers are conventio...

CVE-2026-77856

ash_typescript (Elixir/BEAM library by ash-project) contains a resource-exhaustion flaw in resolve_typed_struct_field/2 within field_selector.ex. When a client-supplied field name on a typed struct field has no match in the reverse map, the code falls back to String.to_atom/1 before any field-exi...

CVE-2026-48932

A flaw in the Node.js HTTP client can cause request desynchronization in Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. The root cause is that Node.js may omit headers beyond maxHea...

CVE-2026-65643

cPanel & WHM versions prior to 11.138.0.2 (and older branches 11.110, 11.134, 11.136) contain an eval injection in the domain parking and addon domain functionality. An authenticated user with permission to add parked or addon domains can create arbitrary files on the server, escalating to code e...

CVE-2026-67394

Plesk for Linux versions 18.0.34 through before 18.0.79.9 and 18.0.80.5 are affected by a critical local privilege escalation via OS command injection (CVSS 4.0: 9.0). An attacker who already has shell access (or is allowed to change their own shell) can escalate to the root account on the hostin...

CVE-2026-67395

A path traversal vulnerability in Sage Employee Self Service (part of Sage HRMS) arises from improper validation of file path parameters in the custom logo functionality. An unauthenticated remote attacker can leverage directory traversal sequences and their encoded variants to bypass directory r...

CVE-2026-18743

popt (specifically the poptConfigFileToString function in popt-static/popt-devel) contains a short realloc bug that can cause heap metadata corruption when a host loads specially crafted configuration content. Successful exploitation results in a low-impact denial of service due to process unavai...