CVE-2026-81799

An unauthenticated Broken Access Control vulnerability was discovered in the Return Refund and Exchange For WooCommerce WordPress plugin, affecting versions ≤ 4.6.4 . The flaw was identified by babyhack (@OPCIA) and carries a CVSS 3.1 score of 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C...

CVE-2026-81795

CVE-2026-81795 affects the WordPress plugin Page Visits Counter – Lite in versions ≤ 1.2.3 , introducing an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw requires user interaction and has a CHANGED scope , meaning successful exploitation can impact the victim's browser sessio...

CVE-2026-81796

Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...

CVE-2026-81794

CVE-2026-81794 affects the Shirt Product Designer for WooCommerce plugin version 1.0.4 , introducing an unauthenticated Broken Access Control vulnerability. An attacker can exploit this over the network with low complexity, no required privileges, and no user interaction, resulting in a high impa...

CVE-2026-81793

An unauthenticated Broken Access Control vulnerability affects the WordPress Salon booking system plugin in versions 10.31.5 and earlier . Discovered by Tiago Ventura (@perses), the flaw allows attackers to access or modify data with low integrity and low availability impact without requiring any...

CVE-2026-81791

The WordPress EventON plugin , versions

CVE-2026-81789

Advanced Product Fields Extended for WooCommerce WordPress plugin, versions ≤ 3.1.6 , is affected by an unauthenticated arbitrary file deletion vulnerability. The CVSS 3.1 score is 8.6 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating a network-exploitable issue requiring no...

CVE-2026-81788

CVE-2026-81788 affects the WordPress IMPress for IDX Broker plugin in versions

CVE-2026-81787

CVE-2026-81787 affects the WordPress plugin IMPress for IDX Broker (versions ≤ 3.3.0 ). The vulnerability is an unauthenticated Broken Authentication flaw, meaning an attacker with network access and no prior credentials can exploit it. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:...

CVE-2026-81786

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

CVE-2026-81785

CVE-2026-81785 affects the WordPress BuddyForms plugin , versions 2.9.0 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker can exploit it over the network without any credentials or user interaction. The CVSS v3.1 score is 6.5 (Medium) , with low...

CVE-2026-81784

An unauthenticated PHP Object Injection vulnerability affects the WordPress Wise Chat plugin in versions ≤ 3.4 , as discovered by Peng Zhou . The flaw allows a remote attacker with no prior access or user interaction to inject a crafted serialized object, leading to high impact on confidentiality...

CVE-2026-81783

CVE-2026-81783 affects the WordPress plugin MailMunch – Grow your Email List , versions ≤ 3.2.5 . The vulnerability is a Broken Authentication flaw exploitable by users with the Subscriber role. Discovered by Jakub Herman , it carries a CVSS 3.1 score of 7.1 (HIGH) with the vector AV:N/AC:L/PR:L/...

CVE-2026-81275

The WordPress Youzify plugin (versions

CVE-2026-81782

WordPress WP Docs plugin versions up to 2.3.1 contain a Cross-Site Scripting (XSS) vulnerability accessible to Subscriber-level users. The CVSS v3.1 score is 6.5 (Medium) , with a network attack vector, low complexity, required user interaction, and a changed scope resulting in low impact on conf...

CVE-2026-78536

CVE-2026-78536 affects the Robokassa payment gateway for Woocommerce WordPress plugin in versions 1.8.9 and earlier . The vulnerability is an unauthenticated Broken Access Control , meaning an attacker with no prior credentials can exploit it over the network. The CVSS 3.1 score is 6.5 (Medium) w...

CVE-2026-66674

CVE-2026-66674 affects the Simple Cloudflare Turnstile WordPress plugin, versions

CVE-2026-66632

CVE-2026-66632 is an unauthenticated Content Injection vulnerability in the WordPress plugin Simple Cloudflare Turnstile , affecting versions 1.42.1 and earlier . Discovered by kta1kri , the flaw allows a remote attacker with no prior access or user interaction to inject content, carrying a CVSS ...

CVE-2026-85310

A Path Traversal vulnerability exists in the import_contacts function of the Groundhogg WordPress plugin, affecting versions ≤ 4.7.1 . The CVSS 3.1 score is 6.5 (Medium) , indicating a network-attack vector with low complexity, low privileges required, and a high impact on confidentiality but no ...

CVE-2026-45747

Suricata versions prior to 7.0.16 are affected by a null pointer dereference in the Lua TLS certificate information helper (TlsGetCertInfo). When a Lua script requests certificate details for TLS traffic where some fields are absent, Suricata can be crashed, resulting in a denial of service . The...

CVE-2026-46387

Suricata , a network IDS/IPS/NSM engine, is affected by a decompression bomb vulnerability in its HTTP/2 decompression path . Prior to versions 7.0.16 and 8.0.5 , a crafted HTTP/2 DATA payload using a high compression ratio (gzip, deflate, or brotli) could cause Suricata to allocate excessive mem...

CVE-2026-88790

proma-ai Proma versions up to 0.19.37 contain a path traversal vulnerability in the File Preview Service component, specifically in the resolveTargetPath function within apps/electron/src/main/lib/file-preview-service.ts. The root cause is a basename-collision fallback that allows an attacker to ...

CVE-2026-75584

ION-DTN before 4.2.1-a.1 contains a denial-of-service vulnerability in the canonicalizePayloadBlock() function in bpsec_util.c . The function passes bundle->payload.length to zco_clone() without validating it against zero. An unauthenticated remote attacker can send a BPv7 bundle with a zero-l...

CVE-2026-64838

ICEcoder (a web-based code editor) versions through 8.1 are affected by a path traversal vulnerability in the oldFileName parameter used during file move and rename operations. Because the parameter is not properly validated, an authenticated attacker can inject path traversal sequences to reloca...

CVE-2026-64837

ICEcoder through 8.1 is vulnerable to OS command injection in lib/properties.php . The root cause is an unescaped filesystem path passed to a shell command via popen() . An authenticated attacker can create directories containing shell metacharacters in their names and then invoke the Properties ...

CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint. The root cause is a logic error in the File::check() validation function, which compares realpath() to boolean true—a condition that never succeeds, effectively disabling the document-root confineme...

CVE-2026-12682

Ankaref Innovation and Technology Inc. LIBRID/LIBREF is affected by a Stored XSS vulnerability caused by improper input neutralization during web page generation. The issue affects versions from 2.01.0.2183 through 10092026 . The CVSS v3.1 score is 5.4 (Medium) with a network attack vector, low c...

CVE-2026-88921

MISP (versions ≤2.5.45) contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, used during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type...

CVE-2026-6285

CVE-2026-6285 is an Improper Authentication vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF , affecting versions 2.01.0.2183 through 10092026 . The root cause is a weak password recovery mechanism for forgotten passwords, allowing remote exploitation of the recovery flow. Th...

CVE-2026-85217

Autodesk Fusion Desktop is vulnerable to a Man-in-the-Middle (MITM) attack via a maliciously crafted add-in that, when installed and executed, can modify persistent network proxy settings without user notification or consent. A successful exploit allows an attacker to redirect authenticated Fusio...

CVE-2026-45763

Suricata 8.0.0 through 8.0.4 contains a flaw in its Lua sandbox where the security.lua.max-bytes memory limit was not consistently enforced for certain new allocation patterns. When Lua rules are enabled and an affected script is loaded, crafted allocation patterns could exceed the configured lim...

CVE-2026-12683

CVE-2026-12683 is a Stored XSS vulnerability in the management panel (Yönetim panel) of Ankaref Innovation and Technology Inc. LIBRID/LIBREF , caused by improper neutralization of input during web page generation. The issue affects versions 2.01.0.2183 through 10092026 . The CVSS 3.1 score is 5.4...

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to Server-Side Request Forgery (SSRF) via an IPv6 transition address bypass in HostCheck::ipAddressIsNotInternal(). The function strips ::ffff: (IPv4-mapped IPv6) prefixes but fails to recognize IPv6 transition addresses that embed private IPv4 addresses—NAT64 ...

CVE-2026-88895

CyberPanel before 3.0.5 fails to enforce two-factor authentication (TOTP) on its API endpoints. Attackers who obtain an administrator's password can derive API tokens from that password and perform administrative operations or create authenticated sessions without the second factor. The vulnerabi...

CVE-2026-88894

Snipe-IT , an IT asset management platform, contains an authorization bypass in its predefined kit checkout path. The root cause is that PredefinedKitCheckoutService never calls the tenant-isolation check ($item->canCheckoutTo($target)) that all other checkout paths enforce under Full Multiple...

CVE-2026-88893

OpenPanel 's share lookup procedures fail to validate access controls, allowing unauthenticated callers who possess a share link to retrieve argon2id password hashes and full report configurations (event names, filters, breakdown dimensions). This enables offline password cracking and theft of bu...

CVE-2026-88892

OpenPanel , an analytics platform, has a server-side request forgery (SSRF) vulnerability in its data importer. The parseRemoteFile function in packages/importer/src/providers/umami.ts calls plain fetch() on a caller-supplied fileUrl validated only by z.string().url(), bypassing the project's exi...

CVE-2026-88891

OpenPanel fails to enforce its read-only project access level on 26 of 29 mutating procedures , caused by missing access level validation in mutation resolvers. Attackers with explicit read-only access can modify, delete, and publish project data , including deleting reports and dashboards, sched...

CVE-2026-88890

OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder . The root cause is a failure to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses . An authenticated attacker holding project-scoped read or...

CVE-2026-88889

Renovate (dependency update automation tool) versions before 44.14.7 contain a command injection vulnerability in the Maven Wrapper manager . An unescaped distributionType parameter in maven-wrapper.properties allows attackers to inject shell commands, leading to remote code execution when Renova...

CVE-2026-88888

Renovate before 44.14.7 is affected by a command injection vulnerability in the Mix manager . The root cause is unescaped organization parameters when processing private dependencies, allowing attackers to inject shell metacharacters through malicious package names. Successful exploitation enable...

CVE-2026-88887

Renovate (dependency update automation tool) is vulnerable to credential exfiltration when listing tags/digests for container images. The root cause is that Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches registry credentials to the follow-up...

CVE-2026-88886

Renovate (a dependency update automation tool) before 44.14.7 is affected by a command injection in the manager/gradle-wrapper module. The distributionUrl value read from a repository's gradle-wrapper.properties file is not escaped before invoking the Gradle Wrapper CLI. In self-hosted deployment...

CVE-2026-88885

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager . When processing unescaped depName parameters in import-path update commands with binarySource=docker mode, attackers can inject shell metacharacters through malicious dependency names to execute arbitrary co...

CVE-2026-88884

Renovate , a dependency update automation tool, is affected by a stability-age bypass in versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0). The root cause is that digest updat...

CVE-2026-88883

Renovate versions before 44.14.4 (Mend Renovate CE/EE images before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0) contain an incomplete log sanitisation flaw for TLS private keys used in Mutual TLS. The value of hostRules[].httpsPrivateKey was redacted in its own field but no...

CVE-2026-88882

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images before 15.4.0, helm chart before 10.4.0), when fetching package versions from a NuGet registry , Renovate follows pagination URLs returned in the HTTP Link header without verifying the targ...

CVE-2026-88881

Renovate versions before 44.11.3 are vulnerable to credential exfiltration when following pagination links in the HTTP Link header. The root cause is that the pagination URL returned by a GitHub server is not validated against the originally contacted host, allowing a malicious or compromised ser...

CVE-2026-88880

Renovate before 44.11.3 contains a credential exfiltration vulnerability in its handling of Link headers when following GitLab server pagination . Because Renovate fails to validate Link header destinations, an attacker controlling a compromised GitLab server can specify a Link header pointing to...

CVE-2026-88878

Traefik (HTTP reverse proxy and load balancer) versions v2.8.2 through v2.11.55 and v3.0.0 through v3.7.11 are affected by an HTTP/3 timeout bypass. The respondingTimeouts settings (notably readTimeout, default 60s) are not applied to the HTTP/3 request path because readTimeout is enforced as a d...