CVE-2026-14929

The CVE-2026-14929 entry concerns the JS Help Desk WordPress plugin, affected versions before 3.1.4. The vulnerability is an IDOR where the plugin does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber or higher) to overwrite the content of...

CVE-2026-14927

The CVE concerns FluentCart (WordPress plugin) versions prior to 1.5.3. The issue is lack of authorization/ownership checks when rendering customer order documents identified by sequential numeric IDs, enabling unauthenticated visitors to enumerate and disclose customer PII (names, emails, billin...

CVE-2026-14922

WP Photo Album Plus is affected by a stored cross-site scripting (XSS) vulnerability affecting all versions up to 9.2.03.001. The flaw arises in the photo-comment pipeline due to a decode-after-sanitize (double-encoding) sequence: on write, wppa_do_comment() sanitizes input with wppa_filter_html(...

CVE-2026-14928

The CVE covers the JS Help Desk WordPress plugin before 3.1.4, where the nonce-gated search handler does not perform authorization or ownership checks. This allows any authenticated user (Subscriber and above) to read the subject and full message body of every other user’s support tickets, exposi...

CVE-2026-14847

The vulnerability CVE-2026-14847 affects the Paid Membership Subscriptions WordPress plugin prior to version 3.0.7. One of the plugin’s payment-related AJAX actions does not perform capability checks or nonce validation, allowing any authenticated user with Subscriber-level access or higher to di...

CVE-2026-14843

The CVE concerns the WordPress plugin Events Made Easy prior to version 3.1.4 . The vulnerability arises because the plugin does not verify that the requester is authorized to modify a targeted record during an unauthenticated data-change request; it relies on a public nonce with no per-record to...

CVE-2026-14849

The CVE-2026-14849 entry concerns the Paid Membership Subscriptions WordPress plugin (before 3.0.7). Affected component: member and payment export files written to a predictable location in the uploads directory. Root cause: lack of protection allows unauthenticated users to download these export...

CVE-2026-14834

The CVE applies to the Mailgun for WordPress plugin prior to version 2.2.1. An unauthenticated AJAX action (listed as add_list) does not perform capability or nonce checks, permitting unauthenticated attackers to enrol arbitrary email addresses into the site owner’s configured Mailgun mailing lis...

CVE-2026-14921

The CVE covers the Ultimate Addons for WPBakery Page Builder WordPress plugin prior to version 3.21.5, where the shared link-rendering function Ultimate_VC_Addons::uavc_link_init() is implicated. This causes a stored XSS via the ult_buttons shortcode (as listed in CVE-Catalog/CVE records). Affect...

CVE-2026-14845

Summary: The NewStatPress WordPress plugin before 1.4.5 is affected by an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Top Post widget. Root cause: user input from unauthenticated visitor requests is not properly sanitized/escaped before storage and later output in the w...

CVE-2026-14554

The CVE-2026-14554 entry concerns the Check & Log Email WordPress plugin (pre-2.0.15). Affected component: SQL query construction where parameters are not properly sanitized/escaped, enabling SQL injection when an attacker has administrator privileges. Impact stated: SQL injection with high confi...

CVE-2026-14833

CVE-2026-14833 corresponds to a stored XSS risk in the Lightbox with PhotoSwipe WordPress plugin prior to 5.9.0. The root cause is lack of sanitisation/escaping of a link data attribute when rendering the image lightbox caption, which allows users with author-level access (lacking unfiltered_html...

CVE-2026-14830

The CVE describes a vulnerability in the FlxWoo WordPress plugin prior to version 3.1.1 where the payment status of a checkout session is not verified with the payment processor before marking an order as paid. This allows unauthenticated attackers to complete WooCommerce orders without payment. ...

CVE-2026-14333

CVE-2026-14333 affects the Demi WordPress plugin (before 0.0.7). The vulnerability arises because full-site backup archives are stored in a publicly accessible location with a predictable filename and without access protection. This enables unauthenticated attackers to download complete backups, ...

CVE-2026-14319

The CVE-2026-14319 entry concerns the GiveWP WordPress plugin prior to version 4.16.3. A REST API endpoint does not properly restrict access, allowing unauthenticated users to retrieve recurring-donation records, including names and subscription details of anonymous donors. Root cause is insuffic...

CVE-2026-14317

CVE-2026-14317 : The GiveWP WordPress plugin is vulnerable in versions before 4.16.3. It does not restrict the set of available payment gateways to those enabled by the administrator and derives this from request input, allowing unauthenticated users to complete donations via a payment gateway th...

CVE-2026-18452

CVE-2026-18452 affects DMS+ (Non-Mobile) by Rich Source and is due to use of hard-coded credentials (a fixed API key). Unauthenticated remote attackers can exploit this to gain control over all installed DMS+ devices. The provided metrics indicate a critical impact (CVSS v4.0 10.0; CVSS v3.1 10.0...

CVE-2026-16236

CVE-2026-16236 affects Realtyna Organic IDX plugin for WordPress (

CVE-2026-14483

The CVE-2026-14483 entry describes an unauthenticated Arbitrary File Upload in the Realtyna Organic IDX plugin + WPL Real Estate (

CVE-2026-51371

Technical details for CVE-2026-51371 are not publicly available in the provided documents. There are no affected products, root cause, or fixes described. Monitor for updates from official sources.

CVE-2026-56673

ComfyUI (multiple nodes: LoadImage, LoadImageMask, LoadImageOutput, LoadAudio, LoadLatent, LoadVideo, Load3D) suffers a path traversal in pre-0.28.0 builds where folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory with...

CVE-2026-62416

Technical details for CVE-2026-62416 are not publicly available in the provided documents. Monitor for updates from official sources.

CVE-2026-60011

Technical details for CVE-2026-60011 are not publicly available in the provided documents. No affected products, vectors, or fixes are disclosed. Monitor for updates.

CVE-2026-63563

Technical details for CVE-2026-63563 are not publicly available in the provided documents. Monitor for updates from official advisories; no affected products, vectors, or impact can be confirmed from the supplied data.

CVE-2026-63545

Technical details for CVE-2026-63545 are not publicly available in the provided documents; monitor for updates from CIRCL/JVN.

CVE-2026-66408

Technical details for CVE-2026-66408 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-66407

Technical details are not publicly available in the provided documents. This CVE entry appears reserved; monitor for updates as new information may be published.

CVE-2026-66405

Technical details for CVE-2026-66405 are not publicly available in the provided documents; the entry is reserved with no disclosed specifics. Monitor for updates from referenced sightings (e.g., JVNVU92804348) and future disclosures.

CVE-2026-66404

Technical details about CVE-2026-66404 are not publicly available in the provided documents. No affected products, impact, or remediation information are specified here. Monitor for updates.

CVE-2026-66403

Technical details for CVE-2026-66403 are not publicly available in the provided documents. Monitor the CIRCL sighting and linked JVNVU entry for updates.

CVE-2026-66410

Technical details for CVE-2026-66410 are not publicly available in the provided documents. Monitor for updates as more information may be disclosed in the future.

CVE-2026-66411

Technical details for CVE-2026-66411 are not publicly available in the provided documents. No affected products, versions, or exploitation information are disclosed. Monitor for updates.

CVE-2026-66409

Technical details for CVE-2026-66409 are not publicly provided in the supplied documents. No affected products, root cause, or remediation are listed. Monitor for updates.

CVE-2026-66406

Technical details for CVE-2026-66406 are not publicly available in the provided documents. The entry appears reserved/no details. Monitor for updates from official sources.

CVE-2026-65875

Technical details for CVE-2026-65875 are not publicly available in the provided documents. Monitor for updates; no affected products, impact, or remediation can be identified from the supplied information.

CVE-2026-56672

ComfyUI (node-based diffusion GUI) is affected by a stored XSS in /userdata/{file} prior to version 0.28.0. The handler used web.FileResponse(path), serving uploaded .html/.svg with extension-derived content types, which allowed embedded scripts to execute in the same-origin when a victim visited...

CVE-2026-56671

The CVE-2026-56671 affects ComfyUI prior to 0.28.0. Root cause: get_model_preview in app/model_manager.py constructs a path using os.path.join(folder, filename) with an unrestricted {filename} capture, allowing path traversal via literals like ../, encoded traversal, absolute paths, or an unbound...

CVE-2026-56670

CVE-2026-56670 : ComfyUI’s /view endpoint allowed stored XSS via uploaded SVG files prior to version 0.28.0 because image/svg+xml and related XML content types were not treated as dangerous content. The issue enabled inline serving of uploaded SVGs, permitting script execution in the ComfyUI orig...

CVE-2026-9672

Technical details are not publicly available in the provided documents. Monitor for updates for any affected products, versions, impact, or remediation once disclosed.

CVE-2026-63223

CodeIgniter (PHP framework) prior to version 4.7.4 is affected by an upload validation bypass in the is_image and mime_in rules. If an application preserves the client-supplied filename and stores uploads in a web-accessible, script-enabled directory, a remote attacker could upload executable con...

CVE-2026-63222

CodeIgniter (PHP framework) has a path traversal vulnerability in UploadedFile::move() when the second argument is omitted, allowing an attacker to exploit client-provided filenames to write uploaded content outside the intended directory. This affects prior to version 4.7.4; a fix is available i...

CVE-2026-63221

CodeIgniter (PHP) 4.x contains a SQL injection in the Query Builder deleteBatch() path from 4.3.0–4.7.3. When used with where() conditions, deleteBatch() substitutes bound values into generated SQL and ignores escape flags, allowing user-controlled values to be interpreted as SQL. The issue does ...

CVE-2026-63220

CodeIgniter (PHP)

CVE-2026-62323

CVE-2026-62323 affects Cloudreve prior to 4.17.0 where WOPI viewer sessions can bypass token suffix validation. The WOPI middleware only checks the session ID prefix and does not compare the full access_token to the stored token, allowing a forged suffix to authorize read and, crucially, write op...

CVE-2026-55502

Cloudreve prior to version 4.17.0 contains an OAuth scope bypass in the admin storage policy route POST /api/v4/admin/policy/oauth/signin. The admin route is under RequiredScopes(Admin.Read) and does not apply the local Admin.Write guard used by sibling policy mutation routes, allowing an attacke...

CVE-2026-55499

CVE-2026-55499 (Cloudreve) Prior to version 4.17.0, an authenticated recipient of a single-file share can receive real-time events for files in the owner’s parent folder, not just the shared item. The mechanism subscribes to the owner’s parent ID for a single-file share root, and the event hub fa...

CVE-2026-55497

Summary (CVE-2026-55497): Cloudreve before 4.17.0 is vulnerable to an unbounded memory allocation during image decoding. The built‑in thumbnail and avatar decoders only cap the compressed file size; they do not limit decoded pixel dimensions for PNG/JPEG/GIF, enabling an authenticated user to sub...

CVE-2026-55496

Cloudreve prior to version 4.17.0 exposes email addresses and basic profile metadata for inactive/banned accounts via GET /api/v4/user/search. The underlying bug is that SearchActive does not apply a StatusActive predicate, unlike GetActiveByID/GetActiveByDavAccount, so results include inactive/b...

CVE-2026-43833

CVE-2026-43833 has corroborating detail in PT-2026-66675 describing a stack-based buffer overflow in the upload functionality that enables code execution by an authenticated attacker. The available information does not name affected products or versions, nor provide a patch or workaround. Exploit...

CVE-2026-43832

CVE-2026-43832 has connected details from PT-2026-66674 describing a stack-based buffer overflow in the Cookie parsing methods that could allow code execution when the SafeEnhancement feature is enabled. The exploitation is described as unauthenticated. No remediation steps or affected product ve...