CVE-2026-73361

Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...

CVE-2026-73362

Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...

CVE-2026-73345

Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...

CVE-2026-73351

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

CVE-2026-73355

Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...

CVE-2026-73350

Unauthenticated Broken Authentication in SupportCandy = 3.5.1 versions...

CVE-2026-73348

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-73352

Unauthenticated Broken Access Control in GiveWP = 4.16.5.1 versions...

CVE-2026-73356

Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...

CVE-2026-73189

Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...

CVE-2026-73338

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-73339

Unauthenticated SQL Injection in Modern Events Calendar 7.35.0 versions...

CVE-2026-73343

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-73190

Unauthenticated Cross Site Scripting XSS in WPDM – Premium Packages = 7.0.5 versions...

CVE-2026-73341

Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...

CVE-2026-73342

Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...

CVE-2026-70657

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by defau...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-71539

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

CVE-2026-73187

Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...

CVE-2026-68568

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68567

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

CVE-2026-69189

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

CVE-2026-68939

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

CVE-2026-68565

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

CVE-2026-66793

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...

CVE-2026-66645

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66651

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66643

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

CVE-2026-66679

Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...

CVE-2026-66646

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66644

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66667

Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...

CVE-2026-66635

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-66636

Contributor Cross Site Scripting XSS in Wise Chat = 3.4 versions...

CVE-2026-66637

Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...

CVE-2026-66641

Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...

CVE-2026-66640

Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...

CVE-2026-66639

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

CVE-2026-66638

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66627

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-66621

Unauthenticated Cross Site Scripting XSS in Ultimate Dashboard = 3.11.2 versions...

CVE-2026-66633

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

CVE-2026-66622

Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...

CVE-2026-66629

Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...

CVE-2026-66620

Editor PHP Object Injection in OptionTree = 2.7.3 versions...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-63632

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...