CVE-2026-65548

Contributor Remote Code Execution RCE in Betheme = 28.4.2 versions...

CVE-2026-65543

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-65549

Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...

CVE-2026-65545

Unauthenticated Cross Site Scripting XSS in AI Engine = 3.6.8 versions...

CVE-2026-65544

Unauthenticated Cross Site Scripting XSS in Super Socializer = 7.14.5 versions...

CVE-2026-65547

Subscriber SQL Injection in Creative Mail = 1.6.9 versions...

CVE-2026-65546

Unauthenticated SQL Injection in Qode Tours = 3.1.3.1 versions...

CVE-2026-65517

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-65523

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-65541

Unauthenticated Broken Access Control in Staff Training = 1.0.7 versions...

CVE-2026-65509

Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...

CVE-2026-65542

Unauthenticated Broken Authentication in Super Socializer = 7.14.5 versions...

CVE-2026-65515

Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.35.0 versions...

CVE-2026-65520

Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...

CVE-2026-65513

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65504

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...

CVE-2026-61963

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-61982

Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...

CVE-2026-61964

Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...

CVE-2026-65507

Unauthenticated Privilege Escalation in AIWU = 1.5.6 versions...

CVE-2026-65508

Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...

CVE-2026-65502

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...

CVE-2026-61961

Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...

CVE-2026-61959

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

CVE-2026-53976

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

CVE-2026-53975

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-34502

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...

CVE-2026-28183

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-32469

Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...

CVE-2026-34501

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...

CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2026-32548

Unauthenticated Broken Access Control in SureCart = 4.6.2 versions...

CVE-2026-34191

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

CVE-2026-28169

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...

CVE-2026-28172

Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...

CVE-2026-28180

Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...

CVE-2026-28146

Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...

CVE-2026-28178

Contributor Cross Site Scripting XSS in Powerkit = 3.1.0 versions...

CVE-2026-28179

Shop manager Cross Site Scripting XSS in FiboSearch = 1.33.0 versions...

CVE-2026-28177

Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...

CVE-2026-28111

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2026-28143

Unauthenticated Cross Site Scripting XSS in Forminator = 1.56.0 versions...

CVE-2026-28139

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-28141

Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...

CVE-2026-28140

Unauthenticated Broken Access Control in JetFormBuilder = 3.6.4.1 versions...

CVE-2026-28005

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...

CVE-2026-25403

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-28082

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

CVE-2026-19045

A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component getcredentialfromuser. This manipulation of the argument Description causes command injection. It is...