CVE-2026-104741: Missing Authorization

The AI Puffer – Chat. Create. Automate. formerly AI Power plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-15178: Missing Authorization

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access an...

CVE-2026-108593: Improper Control of Generation of Code

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

CVE-2026-66568: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Original = 1.9.0 versions...

CVE-2026-66566: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Ambient = 1.7 versions...

CVE-2026-108115: Server-Side Request Forgery (SSRF)

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

CVE-2026-108634: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit the...

CVE-2026-108631: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE request...

CVE-2026-108620: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint,...

CVE-2026-108618: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titl...

CVE-2026-108610: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other...

CVE-2026-108600: Improper Link Resolution Before File Access

open-multi-agent @open-multi-agent/core 1.5.0 through 1.21.2 contains a link following vulnerability in the filewrite tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the age...

CVE-2026-6723: Incorrect Authorization

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by...

CVE-2026-4791: Improper Neutralization of Input During Web Page Generation

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logout-url shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...

CVE-2026-42705: Missing Authorization

Unauthenticated Broken Access Control in Grand News = 3.4 versions...

CVE-2026-17025: Improper Neutralization of Input During Web Page Generation

The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-16776: Improper Neutralization of Input During Web Page Generation

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-81797: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...

CVE-2026-62025: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in Tailored Tools = 3.0.3 versions...

CVE-2026-62021: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Angio = 1.1.1 versions...

CVE-2026-6243: Improper Neutralization of Input During Web Page Generation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-18558: Improper Neutralization of Input During Web Page Generation

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versions up to, and including, 2.7.13 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-5727: Missing Authorization

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-91136: Improper Limitation of a Pathname to a Restricted Directory

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

CVE-2026-93883: Improper Neutralization of Input During Web Page Generation

The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions up to, and including, 3.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-93746: Authorization Bypass Through User-Controlled Key

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest printdocumentfromthemaillink handler dispatched from...

CVE-2026-87780: Improper Neutralization of Input During Web Page Generation

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it...

CVE-2026-57806: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9...

CVE-2026-62030: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in StreamCast = 2.4.5 versions...

CVE-2026-40805: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Deletion in PeepSo = 9.0.5.4 versions...

CVE-2026-65459: Missing Authorization

Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...

CVE-2026-62118: Missing Authorization

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...

CVE-2026-62091: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Armania = 1.4.8 versions...

CVE-2026-62086: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Juno = 2.25 versions...

CVE-2026-62066: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Volos = 1.2 versions...

CVE-2026-62053: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Wine House = 3.20 versions...

CVE-2026-108545: Uncontrolled Resource Consumption

SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 50...

CVE-2026-108679: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to...

CVE-2026-108658: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full systenant records,...

CVE-2026-108655: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron...

CVE-2026-108645: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move...

CVE-2026-108583: Server-Side Request Forgery (SSRF)

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...

CVE-2026-103912: Improper Neutralization of Input During Web Page Generation

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the ' ' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103427: Improper Neutralization of Input During Web Page Generation

The Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and including, 4.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-108668: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-b...

CVE-2026-108581: Missing Authorization

TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain...

CVE-2026-102401: Improper Neutralization of Input During Web Page Generation

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and including, 3.3.71 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-92975: Improper Privilege Management

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.3 via the createsupportuser function. This is due to the function identifying the support account solely by matching against publicly...

CVE-2026-62027: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Team Section Block = 2.0.4 versions...

CVE-2026-108654: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...