CVE-2026-61376

CVE-2026-61376 affects ELECOM wireless LAN routers and access points. The flaw is an OS Command Injection in the Restore Settings function, allowing an attacker who can log in to the product to execute arbitrary OS commands. Connected documents confirm the vulnerability and generic impact (arbitr...

CVE-2026-59764

Summary: CVE-2026-59764 affects ELECOM wireless LAN routers and access points. The issue is an OS command injection in the WebUI that enables an attacker who can log in to the product to execute arbitrary OS commands. The vulnerability is supported by multiple sources (NVD entries) with confirmed...

CVE-2026-44387

Summary (CVE-2026-44387): ELECOM wireless LAN routers and access points are affected by a reflected cross-site scripting vulnerability in the WebUI. Exploitation could allow an arbitrary script to run in a logged-in user’s browser. No exploitation details are provided in the connected documents b...

CVE-2026-15267

CVE-2026-15267 affects the Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress (versions up to 5.0.9). The vulnerability is an SQL injection in the wppm_proj_filter parameter caused by insufficient escaping and flawed query preparation: the value is re-r...

CVE-2026-12800

The CVE-2026-12800 affects the Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to 6.2.0). A SQL Injection exists via the code parameter in the POST /wp-json/wpdmpp/v1/cart/coupon REST endpoint. Root cause: user-supplied code is interpolated directly into a raw ...

CVE-2026-13161

CVE-2026-13161 affects the WordPress plugin TrueBooker – Appointment Booking and Scheduler System up to version 1.2.2. The vulnerability is a generic SQL Injection via the parameter alldata[truebooker_user], caused by insufficient escaping and inadequate preparation of the underlying SQL query. I...

CVE-2026-14516

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a time-based SQL Injection via the staff_ids parameter in all versions up to 27.5. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Impact: unauthenti...

CVE-2026-8167

CVE-2026-8167 describes a Reflected XSS vulnerability in THEWP Digital Solutions’ News Theme V8. The issue stems from improper neutralization of input during web page generation , enabling reflected cross-site scripting. Affected product: News Theme V8 (up to 16.06.2026). The documents do not pro...

CVE-2026-55977

Technical details about CVE-2026-55977 are not publicly available in the provided documents; monitor for updates from NVD and CVE sources.

CVE-2024-14041

Bouncy Castle for Java versions 1.73 to before 1.78 is affected by a timing-side-channel in ML-KEM (CRYSTALS-Kyber) decapsulation. Three routines divide secret-derived polynomial coefficients by the modulus q: Poly.toMsg (decoding the decrypted message) and the ciphertext compression routines Pol...

CVE-2026-12741

CVE-2026-12741 affects the WordPress plugin WP Fast Total Search – The Power of Indexed Search, vulnerable via the form_data[s] parameter. All versions up to 1.80.280 fail to properly escape the user-provided input and do not sufficiently prepare the SQL query, enabling unauthenticated attackers ...

CVE-2026-11756

Technical details for CVE-2026-11756 are not publicly available in the provided documents. No specifics on affected product versions, vectors, or mitigations are provided. Monitor for updates from the sources.

CVE-2026-65547

The CVE-2026-65547 entry is supported by a connected vulnerability entry for WordPress Creative Mail plugin by Constant Contact (versions <= 1.6.9). The issue identified is an SQL Injection vulnerability discovered in the Creative Mail plugin by Taichi Kashimura. Affected product/component: Wo...

CVE-2026-65548

CVE-2026-65548 : Affected product: WordPress Betheme theme (versions ≤ 28.4.2). Vulnerability : Remote Code Execution (RCE). Root cause/scope : Reported as an RCE in Betheme, as described by PatchStack; no further technical details are provided in the connected documents. Impact : Not detailed in...

CVE-2026-65549

CVE-2026-65549 is linked to a concrete issue in the WordPress plugin like Jeg Elementor Kit,

CVE-2026-15730

GamiPress (WordPress plugin)

CVE-2026-15673

CVE-2026-15673 affects the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” up to version 3.9.7. It is a second‑order SQL Injection where insufficient escaping in the update_option‑stored values in checkout_payment_plans and order_status allo...

CVE-2026-15671

The CVE-2026-15671 entry concerns the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” (versions ≤ 3.9.7). It describes a generic SQL Injection via the id parameter caused by insufficient escaping and lack of proper query preparation in an ex...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to and including 3.9.7, due to insufficient escaping of the user-supplied parameter and inadequate...

CVE-2026-15014

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery WordPress plugin (up to version 3.9.7) is affected by an authentication bypass. The root cause is in processRegistration(), which relies on a phone-unbound $_SESSION['sa_mobile_verified'] flag as the sole gat...

CVE-2026-14924

CVE-2026-14924 affects the Tablesome Table WordPress plugin prior to version 1.1.31. The issue arises because one AJAX action does not perform authentication, capability, or nonce checks, allowing unauthenticated users to create new published posts and overwrite arbitrary existing posts and pages...

CVE-2026-14926

The CVE describes a vulnerability in the FluentCart WordPress plugin prior to version 1.4.0 where several payment-method endpoints do not verify that a subscription belongs to the requesting customer. This IDOR-like flaw lets any authenticated user act on another user’s subscription—changing its ...

CVE-2026-14870

The CVE pertains to the Database for Contact Form 7, WPforms, and Elementor forms WordPress plugin before 1.5.3. The issue is a Reflected Cross‑Site Scripting vulnerability caused by improper sanitisation and escaping of an input parameter before it is reflected on an admin page, which could impa...

CVE-2026-14819

CVE-2026-14819 affects the WordPress plugin Event Tickets and Registration (prior to version 5.28.4). The issue is an improper escape of event titles in the ticket history log, enabling a Stored XSS attack that can execute in higher-privileged contexts on multisite installations. The vulnerabilit...

CVE-2026-14821

The CVE-2026-14821 entry concerns the Quiz and Survey Master (QSM) WordPress plugin, affected up to version 11.1.4 (i.e., before 11.1.5). The root cause is a missing capability check when deleting output templates in the plugin, which permits users with contributor-level access and above to delet...

CVE-2026-14545

CVE-2026-14545 concerns the TrueBooker WordPress plugin prior to version 1.2.4. The issue is that password resets through a front-end account handler do not validate account ownership, allowing an unauthenticated attacker to set an arbitrary password on any account (including an administrator) an...

CVE-2026-16587

Technical details for CVE-2026-16587 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-16585

Technical details (affected versions, root cause, impact, and fixes) are not publicly available in the provided documents; monitor for updates.

CVE-2026-16811

Technical details for CVE-2026-16811 are not provided in connected documents; the initial description summarizes a time-based SQL injection via the 'orderby' parameter in ShopLentor

CVE-2026-15136

Technical details beyond what is provided in the initial document are not publicly available in the supplied materials. Monitor for updates to verification, remediation status, and affected versions.

CVE-2026-16797

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement for WordPress (plugin) is affected up to version 3.4.5 by an Insecure Direct Object Reference via the optionSection parameter. The flaw arises from missing validation on a user-controlled key, enabling authenticated attackers with con...

CVE-2026-14490

The CVE concerns the Demi – One Click Demo Import, WP Backup & Site Migration WordPress plugin. All versions up to 0.0.7 are affected due to the plugin storing its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible uploads subdirectory without protection. The una...

CVE-2026-15012

The CVE concerns the WordPress plugin Demi – One Click Demo Import, WP Backup & Site Migration . It is affected through an Arbitrary Directory Copy vulnerability in all versions up to and including 0.0.8, exploitable via the handle_restore_step function. The flaw arises from missing HTTP access c...

CVE-2026-6251

Chaty Pro for WordPress (≤ version 3.5.5) is affected by an authenticated time-based blind SQL injection via the widget_id parameter in POST data. The vulnerability arises because fetch_custom_field() concatenates the raw POST value into a numeric SQL context without proper preparation (no $wpdb-...

CVE-2026-12124

CVE-2026-12124 affects the PDFDraft WordPress plugin (versions up to and including 1.1.0). The issue is a missing capability check on serveTemplatePdfAjax() and a REST route registered with permission_callback => '__return_true' on /wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf, allowing ...

CVE-2026-17528

CVE-2026-17528 affects the nice-select2 JavaScript plugin. Versions before 2.4.1 are vulnerable to XSS via the element, where a malicious payload is rendered into the DOM and can execute arbitrary scripts in a user’s browser when interacting with affected pages. The issue is tied to insufficient...

CVE-2026-17524

The CVE-2026-17524 entry concerns the zip-lib package for Node.js, with versions before 1.1.0 vulnerable to Directory Traversal during extraction via the caching path-validation logic. The root cause is that the isOutsideTargetFolder check is only performed when the initial directory symlink is c...

CVE-2026-18025

CVE-2026-18025 affects Moodle mobile app due to insufficient isolation of secure-storage tokens, enabling access to other Moodle sites’ web service tokens when a user is logged in and uses deep-links. Root cause: token isolation flaw in the Moodle app. Impact: potential compromise of the user’s w...

CVE-2026-51271

In the provided documents, CVE-2026-51271 is linked to the schreibfaul1 ESP32-audioI2S 3.4.5 component. The reported vulnerability is a heap-based buffer overflow in the WAV header parsing function read_WAV_Header(). The function reads untrusted chunk size and bytes-to-skip values directly from m...

CVE-2026-51261

The CVE-2026-51261 entry refers to a vulnerability in schreibfaul1 ESP32-audioI2S 3.4.5 where missing mutex synchronization in AudioBuffer::freeSpace() creates a race condition between concurrent tasks. The function computes available buffer space without protecting shared read/write pointers, re...

CVE-2026-51273

CVE-2026-51273 entry is rejected/not used per the initial description.

CVE-2026-51267

CVE-2026-51267 entry is rejected/not used; not a security issue.

CVE-2026-51259

The CVE-2026-51259 entry has concrete details in connected sources: the vulnerability is an unchecked unsigned integer overflow in buffer size calculation within the schreibfaul1 ESP32-audioI2S 3.4.5 product. This overflow causes an undersized PSRAM buffer allocation, which in turn leads to heap ...

CVE-2026-63633

The connected OSV/PTSecurity entries indicate security issues fixed in the freerdp-3.30.0-1.1 package for openSUSE Tumbleweed GA media. CVE-2026-63633 itself is described here as a reserved placeholder with no explicit details in the provided documents; no root-cause or impact for this CVE is sta...

CVE-2026-51263

CVE-2026-51263 entry is rejected/not used per the initial description.

CVE-2026-51252

The connected records identify a concrete issue: ESP32-audioI2S 3.4.5 contains a buffer overflow in MP3Decoder::UnpackSFMPEG1 caused by missing input validation on attacker-controlled MP3 metadata. This is a vulnerability in the MP3 decoding path; exploitation details are not provided in the docu...

CVE-2026-51260

CVE-2026-51260 affects the schreibfaul1 ESP32-audioI2S component (version 3.4.5). The issue is an unsafe fixed-size memcpy in AudioBuffer::writeSpace(), where a full UINT16_MAX bytes are copied without validating available destination space, causing an out-of-bounds heap write. This is the concre...

CVE-2025-33209

Technical details for CVE-2025-33209 are not publicly available in the provided documents. Monitor for updates; no information on affected products, impact, or remediation is provided.

CVE-2026-51254

CVE-2026-51254 is rejected/not used; this record does not represent an active vulnerability.

CVE-2026-51268

Summary of concrete details found : CVE-2026-51268 is connected to a heap-based buffer overflow in ESP32-audioI2S 3.4.5, affecting the host parsing logic. The dismantle_host()/host() parsing of untrusted host and URL input leads to copying parsed segments (host, request_host, extension, query_str...