CVE-2026-124970

The WP BASE Booking plugin (wp-base-booking-of-appointments-services-and-events) for WordPress is affected by a Blind SQL Injection vulnerability in versions 6.5.2 and below . The root cause is the improper neutralization of special elements used in SQL commands. This vulnerability allows an atta...

CVE-2026-125852

The Realtyna Organic IDX plugin (real-estate-listing-realtyna-wpl) for WordPress is vulnerable to a Path Traversal vulnerability (CWE-22) in versions up to 5.5.0 . This flaw allows for Arbitrary File Deletion , potentially impacting the availability of the application. Specific details regarding ...

CVE-2026-125853

The Everest Backup WordPress plugin (versions up to and including 2.3.15 ) is susceptible to a Missing Authorization vulnerability. This flaw allows for the exploitation of Incorrectly Configured Access Control security levels, specifically identified as a Broken Access Control issue. The vulnera...

CVE-2026-125837

The Make WordPress theme (versions up to and including 1.10.10 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. This issue is caused by the improper neutralization of input during web page generation. While the specific vulnerable components are not detailed, the flaw allows for po...

CVE-2026-125855

The Elextensions ELEX WordPress HelpDesk & Customer Ticketing System plugin (versions

CVE-2026-125854

The WordPress Unbounce Landing Pages plugin (versions

CVE-2026-103769

The PDF Invoices and Packing Slips For WooCommerce WordPress plugin (versions n/a through 1.4.10 ) is vulnerable to a PHP Object Injection flaw caused by the deserialization of untrusted data . An attacker with high privileges could potentially exploit this vulnerability to achieve Object Injecti...

CVE-2026-125452

The Denishua WPJAM Basic WordPress plugin (versions 7.1.2 and below ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. This vulnerability arises from the improper neutralization of input during web page generation, allowing an attacker to execute arbitrary scripts in a user's browser...

CVE-2026-82175

Dell PowerStore is affected by a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this flaw to reach internal network services from the appliance. No specific software versions, root causes, or remediation steps are provided in the documents. Exploitation...

CVE-2026-123975

The Grid Community Toolkit (versions before 6.2.20261111) and globus-gss-assist (before 12.9) are vulnerable to a heap out-of-bounds write in the globus_gss_assist_token_get_fd() function. This flaw is triggered by processing SSLv2 record lengths below 3. Remote unauthenticated clients can exploi...

CVE-2026-128990

The xschem versions 2.9.9 through 3.4.7 are affected by a heap out-of-bounds write vulnerability in the read_dataset() function within src/rawtovcd.c . This issue stems from an unchecked variable index , allowing an attacker to provide a crafted ngspice .raw file that, during conversion via rawto...

CVE-2026-128991

The software xschem (versions 2.9.9 through 3.4.7 ) contains an out-of-bounds read vulnerability within the read_xschem_file() function in src/save.c. The flaw arises because the software mishandles embedded-symbol records that lack a preceding instance. An attacker can provide a crafted schemati...

CVE-2026-109092

The X.Org Server and X.Org xwayland (versions before 21.1.26 and 24.1.15 , respectively) are vulnerable to a shared-memory bounds overflow (CWE-191). The issue stems from the incorrect handling of negative sizes during the processing of ProcXvShmPutImage requests. A local authenticated X client c...

CVE-2026-107522

The Dell PowerStore system is affected by an Improper Authorization vulnerability (CWE-863). An authenticated user can exploit this flaw to potentially achieve privilege escalation to administrator status. The vulnerability has a base score of 7.2, categorized as HIGH severity, with potential imp...

CVE-2026-125802

The Brainstorm Force Spectra ultimate-addons-for-gutenberg WordPress plugin is affected by an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201). This issue allows an attacker to retrieve embedded sensitive data from the plugin. The vulnerability impacts Spectra versions fr...

CVE-2026-125825

The WordPress RepairBuddy plugin (computer-repair-shop) by Webful Creations is vulnerable to a Missing Authorization issue (CWE-862). This flaw allows an attacker to exploit Incorrectly Configured Access Control Security Levels . The vulnerability affects versions from n/a through 4.1236 . The im...

CVE-2026-109445

The PLANET GS-5220-8P2T2S (hardware version 3.0) is affected by a stack-based buffer overflow in firmware versions prior to 3.2412b261008 . The vulnerability exists because the system copies an oversized webstax_auth HTTP Cookie value into a fixed-size stack buffer without performing proper lengt...

CVE-2026-107523

Dell PowerStore is susceptible to an integer overflow vulnerability. An adjacent attacker could exploit this flaw to bypass volume bounds checks, which may result in data destruction or a denial of service . No specific exploit details or remediation steps are provided in the documents beyond a r...

CVE-2026-125794

The Extension for Leaflet Map WordPress plugin (versions n/a through 6.1.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation , which allows an attacker to inject malicious scripts. While the impact is rat...

CVE-2026-125792

The Andy Moyle Church Admin WordPress plugin versions up to and including 5.1.8 are affected by a Missing Authorization vulnerability (CWE-862). This Broken Access Control issue allows attackers to exploit incorrectly configured access control security levels. The vulnerability results in a LOW i...

CVE-2026-125831

The PowerPack Lite for Beaver Builder WordPress plugin (versions

CVE-2026-125834

The WP Media Imagify plugin (versions n/a through 2.3.4 ) contains a Missing Authorization vulnerability. This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels , which could impact the confidentiality of the system. No specific exploit details or remediation steps ...

CVE-2026-125827

The WordPress Event Tickets plugin (versions

CVE-2026-125811

The myCred WordPress plugin (versions 4.0.2 and below ) is vulnerable to a Blind SQL Injection flaw caused by the improper neutralization of special elements used in SQL commands. An attacker could potentially exploit this to interact with the underlying database. No specific exploit links or rem...

CVE-2026-125810

The myCred WordPress plugin (versions

CVE-2026-125809

The myCred WordPress plugin (versions

CVE-2026-125440

The s2Member WordPress plugin (versions

CVE-2026-124412

The eLightUp Slim SEO WordPress plugin is vulnerable to a Basic XSS vulnerability due to the Improper Neutralization of Script-Related HTML Tags in a web page. This flaw allows for Code Injection and affects versions from n/a through 4.11.5 . While specific exploit details and remediation steps a...

CVE-2026-111547

Dell PowerStore is affected by an out-of-bounds read vulnerability (CWE-125). An attacker could exploit this flaw to cause a denial of service or achieve limited information disclosure . No specific component, version, or exploit details are provided in the documents. Remediation can be found via...

CVE-2026-125821

The MapSVG WordPress plugin (versions

CVE-2026-125835

The Crocoblock JetTabs WordPress plugin (versions

CVE-2026-124409

The CURCY (woo-multi-currency) WordPress plugin, developed by VillaTheme, is affected by a Missing Authorization vulnerability (CWE-862) in versions 2.2.21 and below . This security flaw allows attackers to exploit incorrectly configured access control security levels . While the vulnerability is...

CVE-2026-125807

The HT Mega (ht-mega-for-elementor) WordPress plugin versions through 3.2.8 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The issue stems from the improper neutralization of input during web page generation , which could allow an attacker to execute malicious scripts in the...

CVE-2026-125808

The HT Mega (ht-mega-for-elementor) WordPress plugin (versions

CVE-2026-125824

The WP Go Maps WordPress plugin (versions

CVE-2026-119102

In Telerik UI for Blazor (versions v12.0.0 through 15.2.0 ), an improper input validation vulnerability allows the Grid , TreeList , and Gantt components to process AI command filters on any model property. This behavior bypasses the declared column allowlist , potentially exposing data outside t...

CVE-2026-125819

The PublishPress Gutenberg Blocks (advanced-gutenberg) WordPress plugin is vulnerable to a Missing Authorization (CWE-862) flaw in versions up to and including 3.7.6 . This broken access control allows for the exploitation of incorrectly configured security levels. No specific exploit details or ...

CVE-2026-118976

Progress Telerik UI for Blazor versions v11.1.0 through v14.0.0 are affected by a relative path traversal vulnerability (CWE-23). The flaw exists within the demo application's Chat AI Integration example , potentially allowing an attacker to read files outside of the chat attachments folder that ...

CVE-2026-128910

The DJI AeroScope Mobile (TP703) is vulnerable to a hard-coded root password (CWE-798) on the 1300 communications board . This flaw affects firmware version 03.00.00.26 (with board firmware 02.00.07.12 through 02.00.08.40 ). An attacker with physical access to the board's serial console can log i...

CVE-2026-128909

The DJI AeroScope Mobile (TP703) is vulnerable to a CWE-347 flaw in the firmware update handler of the uavmonitor_usbv1 management service on the 1300 communications board . The root cause is that the device accepts any image matching a supplied MD5 checksum without verifying a cryptographic sign...

CVE-2026-107524

Dell PowerStore is affected by an integer overflow vulnerability (CWE-190). An authenticated storage host could exploit this flaw to achieve out-of-bounds data access or a denial of service . While the CVSS score reflects high impact across confidentiality, integrity, and availability, no specifi...

CVE-2026-128908

An OS command injection (CWE-78) vulnerability exists in the uavmonitor_usbv1 management service of the 1300 communications board within DJI AeroScope Mobile (TP703) . The flaw occurs because configuration values written without authentication over the management interface are inserted unquoted i...

CVE-2026-127031

Eclipse AAS4J versions before 3.0.1 are vulnerable to an XML External Entity (XXE) and Server-Side Request Forgery (SSRF) issue. The root cause is that XmlSchemaValidator.validateSchema() (and AASXValidator.validateSchema()) uses a default JAXP Validator that resolves external DTDs and entities w...

CVE-2026-128907

The DJI AeroScope Mobile (TP703) is vulnerable to missing authentication in the uavmonitor_usbv1 management service of its 1300 communications board. Affected firmware versions include 03.00.00.26 (TP703) and 02.00.07.12 through 02.00.08.40 (1300 communications board). An unauthenticated attacker...

CVE-2026-128970

Psono Server Community Edition (versions 1.12.6 through 7.5.0) and Enterprise Edition (before 7.5.1) are vulnerable to an authorization bypass in the DELETE /share/right/ endpoint. The system fails to verify if a group membership has been accepted (accepted=True) before authorizing the deletion o...

CVE-2026-109093

A stack buffer overflow exists in the ProcXTestFakeInput DeviceValuator handling within the X.Org Server . This vulnerability affects X.Org xwayland versions prior to 24.1.15 and X server versions prior to 21.1.26 . Authenticated clients can exploit this flaw to cause a crash or execute arbitrary...

CVE-2026-127102

Eclipse BaSyx Go Components versions up to and including 1.1.2 are vulnerable to an incorrect authorization issue in ABAC-enabled deployments of the Submodel Repository and the AAS Environment. The vulnerability exists because the GET /submodels/{submodelIdentifier}/submodel-elements list route i...

CVE-2026-109094

The X.Org Server is vulnerable to an integer overflow in the XRes QueryResourceBytes Swap Path. This flaw can lead to a buffer overflow on 32-bit systems , potentially allowing authenticated clients to crash the X server. Affected versions include Xwayland before 24.1.15 and X Server before 21.1....

CVE-2026-82177

Dell PowerStore is subject to an OS Command Injection vulnerability (CWE-78). A high-privileged attacker could exploit this flaw to achieve arbitrary root command execution on the appliance. Exploitation details and specific affected versions are not provided in the documents, but the vulnerabili...

CVE-2026-128790

Eclipse BaSyx Go Components versions up to and including v1.1.2 contain a vulnerability where ABAC-enabled deployments of the Submodel Repository and the AAS Environment fail to apply FILTERLIST fragment filters during single Submodel reads. Specifically, while GET /submodels correctly filters fi...