CVE-2026-93556

The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the...

CVE-2026-65634

Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of service by sending a crafted OID during the TLS handshake. The BER OID decoder asn1rttber:decsubidentifiers/3 in lib/asn1/src/asn1rttber.erl and the...

CVE-2026-68956

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...

CVE-2026-15095

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-93952

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

CVE-2026-95503

A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center KDC by requesting a server ticket. This...

CVE-2026-93836

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-93778

The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text imported via wpyelpdownloadsource in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-92969

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files...

CVE-2026-91092

The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2026-92235

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible fo...

CVE-2026-74766

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the...

CVE-2026-87080

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decodepunycode. The pure-Perl decoder reads one digit at a time with four-argument substr and tests the result with defined to detect the end of the input. substr on...

CVE-2026-87081

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in toascii. toascii punycode encodes each label and only then applies the 63-byte DNS limit. encodepunycode in both backends follows the sample...

CVE-2026-87082

Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encodepunycode. Neither backend checks that its input is well-formed UTF-8, so a string with the UTF-8 flag set over malformed bytes, as the :utf8 PerlIO layer produces from an...

CVE-2026-7622

The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the senddeactivationsurvey function registered via the wpajaxpl-plugin-deactivation AJAX action. This makes it possibl...

CVE-2026-87079

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decodepunycode. The XS backend inserts each decoded code point into a UTF-8 buffer and finds the insertion point by scanning that buffer from the start, one character ...

CVE-2026-74765

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encodepunycode. The XS backend keeps the punycode delta, and the digit index derived from it, in a signed int. The accumulation delta += m-n h+1 has no overflow check, so...

CVE-2026-87078

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decodepunycode. The XS backend allocates the scalar it returns before it validates the input, sizing the buffer at twice the input length. The scalar is released only on the success path...

CVE-2026-4123

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

CVE-2026-18439

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

CVE-2026-6922

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trashtablebulk and restoretablebulk functions that causes the gua...

CVE-2026-1645

The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customcurrency' parameter and the 'localeurl' setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18345

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-16778

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-1280

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

CVE-2025-1281

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

CVE-2026-12995

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2025-14487

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...

CVE-2025-14486

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14484

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2016-15059

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encodepunycode. The XS backend builds the encoded label in the string buffer of the scalar it returns, sized from the input length. The loop that emits the digits of each...

CVE-2026-91827

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-92438

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user w...

CVE-2026-94504

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-89412

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel v-html on suggestion.original in all versions up to, and including, 3.3.5 due to insufficient input sanitization and outp...

CVE-2026-88788

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

CVE-2026-85653

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'otherattributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-93655

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbcautofill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-12470

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This...

CVE-2026-19658

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2026-13355

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

CVE-2026-94492

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...

CVE-2026-94491

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...

CVE-2026-94493

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-93711

Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to...

CVE-2026-93710

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...

CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...