CVE-2026-108839: Improper Link Resolution Before File Access

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

CVE-2026-108745: Missing Authorization

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

CVE-2026-108851: Missing Authorization

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...

CVE-2026-108568: Insufficient Verification of Data Authenticity

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient...

CVE-2026-108700: Missing Authorization

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

CVE-2026-108696: Authorization Bypass Through User-Controlled Key

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confir...

CVE-2026-108691: Operator Precedence Logic Error

mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to...

CVE-2026-81156: Improper Neutralization of Input During Web Page Generation

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery...

CVE-2026-108875: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to...

CVE-2026-108861: Exposure of Sensitive Information to an Unauthorized Actor

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the executemethod tool. Attackers or prompt-injected agents can call read or searchread through executemethod naming denied fields to receive their value...

CVE-2026-62095: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Biolife = 3.2.3 versions...

CVE-2026-62067: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Kaven = 1.2 versions...

CVE-2026-108664: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to...

CVE-2026-108604: Incorrect Authorization

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...

CVE-2026-101921: Improper Neutralization of Input During Web Page Generation

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-105989: Missing Authorization

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...

CVE-2026-105889: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6...

CVE-2026-104762: Improper Neutralization of Input During Web Page Generation

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104725: Improper Privilege Management

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the user parameter within the processedit function, which allows any...

CVE-2026-104398: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10...

CVE-2026-107120: Improper Authentication

The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to ...

CVE-2026-62034: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Before After Image Comparison – Image comparison for WP = 1.1.21 versions...

CVE-2026-62068: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Teoro = 1.1 versions...

CVE-2026-62065: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Cardea = 2.3 versions...

CVE-2026-62064: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ambed = 1.0.0 versions...

CVE-2026-62054: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Yacht Rental = 2.6 versions...

CVE-2026-62053: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Wine House = 3.20 versions...

CVE-2026-62052: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Tipsy = 1.6 versions...

CVE-2026-62051: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Stargaze = 1.10 versions...

CVE-2026-62050: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Splendour = 1.23 versions...

CVE-2026-62066: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Volos = 1.2 versions...

CVE-2026-62046: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12...

CVE-2026-62045: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0...

CVE-2026-62044: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13...

CVE-2026-62037: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Document Embedder = 2.4.0 versions...

CVE-2026-62077: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Avala = 1.1.4 versions...

CVE-2026-62030: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in StreamCast = 2.4.5 versions...

CVE-2026-62022: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Tonda Membership = 1.0.1 versions...

CVE-2026-62130: Deserialization of Untrusted Data

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency = 5.5.8 versions...

CVE-2026-62129: Unrestricted Upload of File with Dangerous Type

Contributor Arbitrary File Upload in Creator LMS = 1.2.21 versions...

CVE-2026-62125: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Asia Garden = 1.3.1 versions...

CVE-2026-62120: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Law Office = 3.20 versions...

CVE-2026-62117: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

CVE-2026-62116: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

CVE-2026-62115: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in KuteShop = 4.2.9 versions...

CVE-2026-62100: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in KuteShop = 4.2.9 versions...

CVE-2026-62069: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Fabius = 1.0 versions...

CVE-2026-57742: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...

CVE-2026-57806: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9...

CVE-2026-94256: Improper Authentication

The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phon...