CVE-2026-59661

The Repasat application contains a Cross-Site Scripting (XSS) vulnerability (CWE-79) affecting the "nomRuta" parameter at the "/es/routes/update/693" endpoint. Successful exploitation allows an attacker to trick a user into executing arbitrary code within their browser. No specific exploit detail...

CVE-2026-59660

The Repasat application is vulnerable to a Cross-Site Scripting (XSS) vulnerability (CWE-79). The issue is specifically located in the "nomTransportista" parameter at the "/es/carriers/update" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code ...

CVE-2026-59659

The Repasat application contains a Cross-Site Scripting (XSS) vulnerability. The flaw is located in the "nomZonaGeo" parameter at the "/es/geozones/update/149979" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim's browser. N...

CVE-2026-85714

Technical details for CVE-2026-85714 are not publicly available in the provided documents. Action: monitor for updates.

CVE-2026-94180

The Monetizemore Advanced Ads WordPress plugin (versions up to and including 2.0.26 ) is vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639). This flaw allows an attacker to retrieve embedded sensitive data from the application. While the vulnerability details confirm the ...

CVE-2026-94639

The Apache Thrift Java bindings are vulnerable to an uncaught exception and improper handling of exceptional conditions , specifically involving the allocation of resources without limits or throttling . This issue is identified as a residual of CVE-2026-61373, involving a thread-death black hole...

CVE-2026-94405

The Shahjada Download Manager WordPress plugin (versions up to 3.3.71 ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw allows an attacker to retrieve embedded sensitive data from the system. The vulnerability is classified as a Sensitive Data Exposur...

CVE-2026-97652

The WP Statistics WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 14.16.14 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI Query-Parameter Key. This allows unauthenticated attackers to inject arb...

CVE-2026-87920

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.10.6 . The root cause is insufficient input sanitization and output escaping within the Comment Content via Output-Buffer Regex Rewrite . This flaw allows unauthenticat...

CVE-2026-85492

The All in One SEO plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.0.1.1 . The root cause is insufficient input sanitization and output escaping involving the URL Pathname . An unauthenticated attacker can inject arbitrary web scrip...

CVE-2026-94541

The WPMobile.App – Android and iOS App Builder plugin for WordPress (slug wpappninja) is vulnerable to an authorization bypass in all versions up to and including 11.82 . The flaw stems from a failure to verify user permissions when handling the wpapp_category[] parameter. If the plugin's mail-to...

CVE-2026-102731

The Apache Directory LDAP API (versions 1.2.0 before 1.2.9 ) is vulnerable to a memory allocation flaw caused by an excessive size value during BER decoding . A malicious peer or Man-in-the-Middle (MITM) actor can send a small BER-encoded response that triggers a large memory allocation before da...

CVE-2026-59673

The Repasat application is vulnerable to a Cross-Site Scripting (XSS) vulnerability. Specifically, the "nomTipoCli" parameter at the "/es/clientypes/update/109441" endpoint is affected. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim...

CVE-2026-59672

The Repasat application is subject to a Cross-Site Scripting (XSS) vulnerability. The root cause is linked to the "nomGrupoEmpresarial" parameter at the "/es/corporategroups/update/246" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within ...

CVE-2026-94635

A vulnerability exists in the Apache Thrift Lua bindings (versions before 0.25.0 ) caused by the improper handling of length parameter inconsistencies . Specifically, the TBinaryProtocol:readMessageBegin function may bypass checkStringSize on the pre-versioned name, allowing a remote attacker to ...

CVE-2026-80298

A SQL injection vulnerability exists in the HAVELSAN Inc. Sef - AI Chatbot Platform affecting versions before 2.1 . The flaw stems from the improper neutralization of special elements used in SQL commands, which could allow an attacker to execute unauthorized queries. The vendor has stated that t...

CVE-2026-59671

The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The specific affected endpoint is “/es/datatables/getemployeetypesdatatable” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim’s browser. No specific ...

CVE-2026-95512

A flaw exists in the FreeType library, specifically within its CID font loader . A remote attacker could exploit this by tricking a user into opening content containing a specially crafted CID-keyed font . This font can trigger repeated allocations and decryptions of subroutine data across multip...

CVE-2026-95605

The WordPress WP Data Access plugin (versions

CVE-2026-80443

HAVELSAN Inc. Sef - AI Chatbot Platform (versions before 2.1 ) is vulnerable to an improper certificate validation flaw within the API Tool Runner component. This vulnerability allows an Adversary in the Middle (AiTM) to intercept communications. While the impact is rated as High with potential f...

CVE-2026-59670

The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The flaw exists within the "nomListaValidacion" parameter at the endpoint "/es/validationslists/assignList/Employee/45659" . Successful exploitation could allow an attacker to trick a user into executing arbitrary ...

CVE-2026-80337

The HAVELSAN Inc. Sef - AI Chatbot Platform (versions before 2.1 ) is susceptible to a Missing Authorization vulnerability (CWE-862 ). This flaw allows attackers to access functionality that is not properly constrained by Access Control Lists (ACLs) , specifically enabling unauthorized Cross-Chat...

CVE-2026-80464

A Server-Side request forgery (SSRF) vulnerability exists in the API Tool Runner of HAVELSAN Inc. Sef - AI Chatbot Platform . This issue allows an attacker to perform SSRF attacks. The vulnerability affects versions before 2.1 . Notably, the vendor has stated that this product is no longer suppor...

CVE-2026-95607

The WordPress WPLMS theme (versions

CVE-2026-59669

The Repasat application is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the "name" parameter of the endpoint “/es/attachmenttypes/update/203336” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their browser. N...

CVE-2026-91784

The cjbassi/gotop utility is vulnerable to local argument injection within its process termination functionality. The software fails to sanitize process names before passing them directly to the pkill command. A local attacker can exploit this by creating a process with a crafted name starting wi...

CVE-2026-96327

A SQL Injection vulnerability exists in the WordPress WPLMS plugin for versions prior to 1.9.9.8.2 . The flaw was identified by Rafie Muhammad. While the specific root cause and practical impact are not detailed in the provided documents, users are advised to update to version 1.9.9.8.2 or later ...

CVE-2026-95608

The WordPress HUSKY plugin (versions

CVE-2026-94670

The Everest Forms plugin for WordPress (versions

CVE-2026-95595

The WordPress Plugin Disable and Remove Google Fonts | GDPR & DSGVO friendly (versions

CVE-2026-95610

The UpSolution Core plugin for WordPress (versions

CVE-2026-18036

Bouncy Castle for Java versions prior to 1.86 are vulnerable to a timing side-channel attack in the NTRU implementation. The root cause is the use of the % operator in three helpers, leading to integer division where latency depends on the secret operand. Specifically, Polynomial.modQ divides by ...

CVE-2026-96461

A Broken Access Control vulnerability exists in the Amelia WordPress plugin, affecting versions

CVE-2026-96337

The WordPress ProfilePress plugin (versions

CVE-2026-96518

The WordPress ProfilePress plugin (versions

CVE-2026-96333

The WordPress GiveWP plugin (versions

CVE-2026-96553

A Cross Site Scripting (XSS) vulnerability was discovered in the FiboSearch WordPress plugin, affecting versions

CVE-2026-97637

The JSON API Auth plugin for WordPress (versions up to and including 3.1.2 ) is vulnerable to an Authentication Bypass via cached session cookie disclosure. The root cause is that the required PI-Media/json-api parent plugin caches controller dispatch results using only the URI and query string, ...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.1 . The flaw exists in the OsPaypalConnectController::create_order_for_transaction() action, which is exposed as an unauthenticated route via wp...

CVE-2026-96647

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.1.1 . The root cause is insufficient input sanitization and output escaping of the 'lsd[remark]' parameter. This a...

CVE-2026-97634

The Event Tickets and Registration plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 5.29.5 . The root cause is insufficient escaping of the user-supplied orderby parameter and a lack of sufficient preparation on the existing SQL query. This allows ...

CVE-2026-97338

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.70 . The root cause is insufficient input sanitization and output escaping within the display name field. An authenticated attacker with Subscriber-level access or ...

CVE-2026-95670

The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.2.0 . The root cause is insufficient input sanitization and output escaping within the Log URL via /goto/{base64} Redirect functionality. This flaw allows unauthenti...

CVE-2026-93756

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin (all versions up to and including 4.13.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping when handling Facebook Comment Messages via v-html in...

CVE-2026-100107

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.9.2 . The root cause is insufficient input sanitization and output escaping associated with the 'comment' parameter , specifically involving an SVG Comment Conte...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.6.5.4 . The root cause is insufficient input sanitization and output escaping within the 'choice' Post Meta via the Insert/Update Post Act...

CVE-2026-96871

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.2 . The root cause is insufficient input sanitization and output escaping involving the 'data_type' parameter. This allows unauthenticated attackers to inject arbitrary w...

CVE-2026-103426

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.31.4 . The vulnerability exists because of insufficient input sanitization and output escaping of the '_rt' parameter . An unauthenticated attacker can inject arbit...

CVE-2026-102002

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.2.6 . The root cause lies in the 'otter_form_widget_filter' parameter, which allows authenticated attackers with ...

CVE-2026-96566

The Newsletter – Send awesome emails from WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.4.0 . The root cause is insufficient input sanitization and output escaping within the 'np1' Custom Field Parameter . Unauthenticated attackers can i...