CVE-2026-97318

The Giveaways and Contests by RafflePress WordPress plugin versions prior to 1.12.27 is vulnerable to an unauthenticated stored open redirect . The flaw exists because the plugin fails to properly validate the parent page URL of a giveaway before saving it. An attacker can exploit this to manipul...

CVE-2026-94298

The BuildKit WordPress plugin versions prior to 1.0.29 is vulnerable to a Stored SQL Injection flaw. The root cause is the improper sanitization and escaping of data submitted by contributor-level users before it is stored and subsequently used in a SQL query via the list_content parameter. This ...

CVE-2026-97317

The Giveaways and Contests by RafflePress WordPress plugin (versions before 1.12.27 ) is vulnerable to an unauthenticated reCAPTCHA Secret Key Disclosure . The plugin fails to remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages. This flaw allows unauthent...

CVE-2026-91828

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin (versions before 6.3.11 ) is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because the plugin fails to require authentication or a valid nonce for an action that triggers a slow server-side l...

CVE-2026-91022

The Motors WordPress plugin (versions before 1.4.124 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue occurs because the plugin fails to properly sanitize and escape a listing badge setting before rendering it within an HTML attribute. This allows users with a custom, admini...

CVE-2026-91023

The Motors WordPress plugin (versions before 1.4.124 ) contains a missing authorization vulnerability (CWE-862 ) involving the stm_make_featured function. The plugin fails to verify if a user is authorized to modify a listing before processing management actions. This allows authenticated attacke...

CVE-2026-85016

The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape an icon value before concatenating it into an HTML attribute within the shared widget-parameter processor . This flaw allows u...

CVE-2026-85004

The Popup Maker WordPress plugin (versions through 1.4.5 ) is vulnerable to a missing authorization flaw due to a failure to perform a capability check on the sgpm_connect account-connection action. While the plugin verifies a nonce, it fails to restrict access to specific roles, allowing authent...

CVE-2026-81740

The Paytm Payment Gateway WordPress plugin in versions before 2.8.9 is vulnerable to unauthenticated order status manipulation. The root cause is a failure to verify that payment callbacks genuinely originate from the payment provider when the secret key has not been configured, which is the defa...

CVE-2026-13718

The Tabs Responsive WordPress plugin, affecting versions through 2.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize the content of WooCommerce product tabs before it is stored and subsequently rendered. This flaw allows an attacker with shop manager...

CVE-2026-90988

The Request a Quote WordPress plugin in versions through 2.5.6 is vulnerable to unauthenticated contact record disclosure. The root cause is a missing authorization check on an unauthenticated AJAX handler , specifically involving emd_get_std_pagenum. This allows unauthenticated users to read pri...

CVE-2026-15896

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to a Directory Traversal vulnerability in all versions up to and including 6.3.316 . The root cause lies in the parse_request function, specifically involving the 'sfgtfi' URL path parameter. This flaw allows unauthenti...

CVE-2026-78471

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.15.1 . The root cause is insufficient input sanitization and output escaping of the Comment Author Name . An unauthenticated attacker can inject arbitrary web scripts th...

CVE-2026-92174

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.73.2 . The flaw exists in the 'theme' parameter and is triggered because update_fields() only processes declared form fields, allowing an attacker to bypass validat...

CVE-2026-90438

The Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.15.4 . The root cause is insufficient input sanitization and output escaping within the Paragraph Text (RTE) Field Submission. This allows unauthenticated attackers to inj...

CVE-2026-15897

The Super Forms – Drag & Drop Form Builder plugin for WordPress (all versions up to and including 6.3.316 ) is vulnerable to Privilege Escalation . The flaw exists in the Register & Login add-on's before_email_success_msg() function, which fails to perform ownership or capability checks when proc...

CVE-2026-84925

The Avada | Website Builder For WordPress & WooCommerce theme is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 7.16.1 . The root cause is insufficient input sanitization and output escaping of the 'lang' parameter . Specifically, the injected value is prop...

CVE-2026-92820

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to and including 3.3.34 . The root cause is that the plugin trusts an attacker-supplied file path from form submissions during the External File Upload (Amazon S3) flow. This unvalida...

CVE-2026-86360

Technical details are not publicly available in the provided documents. Action: monitor for updates.

CVE-2026-10026

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to and including 7.6.12 . The root cause is insufficient input validation on the 'Feed Config' field, which is passed directly to the eval() function. This allows authenticated attackers with Administrator-le...

CVE-2026-19660

The Divi Membership plugin for WordPress (versions up to and including 2.3.0 ) is vulnerable to an Authentication Bypass via the process_paypal_callback function. This function, hooked to the init action, accepts a base64-encoded paypal_param GET parameter without IPN validation , cryptographic s...

CVE-2026-93367

The Visitors Traffic Real Time Statistics Pro plugin for WordPress (versions up to and including 11.22 ) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is the lack of sanitization on the page_title parameter within the ahcpro_track_visitor AJAX action, which i...

CVE-2026-14378

The DevKit Pro plugin for WordPress (versions ≤ 2.3.0 ) is vulnerable to an Authentication Bypass leading to full Administrator Account Takeover . The root cause is a flawed user-switch "revert" flow where the revert_switch handler trusts the attacker-controlled original_user_id cookie to identif...

CVE-2026-103977

Technical details for CVE-2026-103977 are not publicly available in the provided documents. Monitor for further updates regarding the affected software, root cause, and remediation.

CVE-2026-104123

The SourceCodester Online Reviewer Management System 1.0 is vulnerable to SQL injection due to an unknown functionality in the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. By manipulating the Title argument, an attacker can execute arbitrary SQL commands. This...

CVE-2026-104120

A server-side request forgery (SSRF) vulnerability exists in the modelcontextprotocol components mcp-server-fetch and mcp-server-everything up to version 2026.6.4 . The flaw is located in the fetch_url function within the file mcp_server_fetch/server.py of the Fetch Tool component. An attacker ca...

CVE-2026-104054

A security flaw in calcom cal.diy up to version 6.2.0 allows for missing authorization due to a vulnerability in the PBAC Permission Engine component. Specifically, the doesUserIdHaveAccessToBooking function within the BookingAccessService.ts file can be manipulated to bypass intended access cont...

CVE-2026-63692

Technical details are not publicly available in the provided documents. This CVE candidate has been reserved by an organization or individual, and further information is expected to be provided once it is publicized. Monitor for updates.

CVE-2026-63688

Technical details for CVE-2026-63688 are not publicly available in the provided documents. Monitor for updates as the entry is currently reserved and lacks specific information regarding affected products or impact.

CVE-2026-104053

The itsourcecode Pet Shop Management System 1.0 is vulnerable to SQL injection via an unknown function in the admin_reservefilter.php file. The flaw occurs because the filter argument is improperly handled, allowing for remote exploitation. While the documents do not provide specific remediation ...

CVE-2026-21140

A vulnerability exists in ManagedProvisioning prior to SMR Sep-2026 Release 1 due to improper access control . This flaw allows local attackers to install arbitrary applications on the affected system. Specific exploit details are not provided in the documents.

CVE-2026-104052

The Pet Shop Management System 1.0 is vulnerable to SQL injection via an unknown function within the admin_reject_completed.php file. The flaw is triggered by the manipulation of the ID argument , allowing an attacker to initiate the attack remotely . Publicly disclosed exploits for this vulnerab...

CVE-2026-104480

Discord libdave versions before 1.2.0 are vulnerable to a flaw where the system fails to reject an MLS Welcome message if the resulting group roster contains an unrecognized participant. An attacker capable of controlling the DAVE signaling path (such as a voice gateway) can manipulate signaling ...

CVE-2026-103098

The GV-Eye software is vulnerable to sensitive information exposure due to the transmission of a sensitive key within the URL query parameter over an unencrypted HTTP connection. Because the request is sent in plaintext rather than via HTTPS, an attacker capable of monitoring network traffic can ...

CVE-2026-103097

The GV-Eye Relay Payment API is vulnerable to an information disclosure flaw where an API key is hardcoded and retrievable from the application package. Because Android applications can be reverse-engineered, an unauthorized user can extract these sensitive credentials from the client application...

CVE-2026-103096

The GV-Eye application is vulnerable to a hardcoded API key issue. Because Android applications can be reverse engineered , an attacker can extract sensitive API credentials directly from the application package. This allows unauthorized users to misuse the key for unintended purposes. No specifi...

CVE-2026-51907

A path traversal vulnerability exists in TaskingAI v0.3.0 within the QR Code Generator plugin . Specifically, the save_base64_image function fails to properly sanitize the project_id parameter, allowing an attacker to write image files to arbitrary locations on the server filesystem. While exploi...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in the delete_user_knowledge function located at superagi/controllers/knowledges.py. The POST /knowledges/delete/{knowledge_id} route allows for the deletion of knowledge objects without requiring authenticatio...

CVE-2026-51917

FinRobot v1.0.0 is vulnerable to a Code Injection vulnerability within the CodingUtils.modify_code component. The vulnerability is associated with CWE-94 (Improper Control of Generation of Code). The base severity is rated as HIGH (7.3) with an attack vector of NETWORK and low attack complexity. ...

CVE-2026-63689

CVE-2026-63689 involves a path traversal vulnerability in the Dell Container Storage Modules (CSM) operator. An attacker with network access can exploit this to write arbitrary files to the host filesystem of a Kubernetes worker node , potentially leading to remote code execution (RCE) and full n...

CVE-2026-71168

The Dell System Update (DSU) software is affected by CVE-2026-71168 , one of five vulnerabilities addressed by Dell. While specific technical details for this CVE are not individually detailed, the related set of vulnerabilities in DSU can allow attackers to execute code with root privileges . To...

CVE-2026-51906

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool saveurlimage function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the projectid parameter...

CVE-2026-51922

agentscope v1.0.20 contains code injection in executeshellcommand src/agentscope/tool/coding/shell.py. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-101207

CVE-2026-101207 involves an authenticated Remote Code Execution (RCE) vulnerability affecting Dell OpenManage Integration and Lenovo XClarity Integration with Windows Admin Center . The root cause allows an attacker with domain user credentials to gain SYSTEM privileges on the WAC host. Impacted ...

CVE-2026-104201

The radsecproxy software is affected by a Heap OOB read/write vulnerability during MS-MPPE key re-encryption . Technical details and remediation are primarily associated with GHSA-wj29-mxmc-q98c . Specific exploit details or direct links are not provided in the documents.

CVE-2026-51904

SuperAGI versions up to v0.0.14 are vulnerable to an improper access control vulnerability within the agent execution controller. Specifically, the functions create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id but fail to verify...

CVE-2026-51901

SuperAGI (versions up to 0.0.14 ) is vulnerable to an Incorrect Access Control issue (CWE-284) within the agent execution controller. The /api/agentexecutions/schedule endpoint fails to validate that an agent_id belongs to the authenticated user's organization. This allows authenticated users to ...

CVE-2026-86361

Dell has patched five vulnerabilities in Dell System Update (DSU) , including CVE-2026-86361 . While specific technical details for this individual CVE are not elaborated upon, the associated flaw CVE-2026-86360 in the same product can allow attackers to execute code with root privileges (CVSS 9....

CVE-2026-51898

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute...

CVE-2026-65949

CVE-2026-65949 involves two authenticated Remote Code Execution (RCE) vulnerabilities affecting Dell OpenManage Integration and Lenovo XClarity Integration with Windows Admin Center . A domain user credential is sufficient to achieve SYSTEM privileges on the WAC host, allowing an attacker to hija...