CVE-2026-97284

The WordPress Icegram plugin (versions

CVE-2026-97281

The WP Project Manager plugin for WordPress (versions

CVE-2026-97277

The Social Boost WordPress plugin, versions 3.6.2 and below , is affected by a Broken Access Control vulnerability (CWE-862) involving subscriber privileges. This flaw allows for unauthorized actions due to insufficient access control checks. The vulnerability has a High severity rating with a CV...

CVE-2026-97273

The Premmerce Wishlist for WooCommerce plugin (versions

CVE-2026-97269

The WPFunnels WordPress plugin (versions

CVE-2026-97268

The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to an unauthenticated Cross Site Scripting (XSS) vulnerability in versions

CVE-2026-97258

The WordPress Aruba Migration Tool plugin (versions

CVE-2026-97260

The MaxGalleria WordPress plugin versions

CVE-2026-97251

The Bus Ticket Booking with Seat Reservation plugin for WordPress versions

CVE-2026-95588

The AcyMailing SMTP Newsletter WordPress plugin, affecting versions

CVE-2026-94390

The Hide Shipping Method For WooCommerce plugin for WordPress versions

CVE-2026-62073

The WP Full Stripe Free WordPress plugin (versions

CVE-2026-62071

The WordPress File Upload plugin (versions

CVE-2026-103752

The WordPress Authorizer plugin versions

CVE-2026-103687

A vulnerability exists in rhukster dom-sanitizer up to version 1.0.15 within the SVG Sanitization component. The flaw is located in the url function of the src/DOMSanitizer.php file, where manipulation can lead to an incomplete blacklist . This issue allows for potential remote attacks , and expl...

CVE-2024-58388

Sharp and Toshiba Tec rebranded multifunction printers are vulnerable to an unauthenticated local file inclusion (LFI) vulnerability. The root cause is the lack of input validation on the path parameter within the installed_emanual_down.html endpoint. Remote attackers can leverage directory trave...

CVE-2026-79900

The boks_ksllogsd component is vulnerable to a heap overflow during KSL checksum initialization. The issue occurs because affected releases verify that OpenSSL recognizes a digest name provided in the MD field of an authenticated KSL start message but fail to validate that the name fits within a ...

CVE-2026-79901

Affected versions of boks_keytabmd in BoKS Manager deployments using BoKS keytab management contain a vulnerability where Active Directory service-account passwords are generated from a predictable pseudo-random sequence. The sequence is seeded with the current Unix timestamp , allowing an attack...

CVE-2026-103686

The rhukster dom-sanitizer library (up to version 1.0.15 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the URL Validation component. Specifically, the DOMSanitizer::isDangerousUrl function in src/DOMSanitizer.php can be manipulated to allow malicious scripts. This vulnerability c...

CVE-2026-66253

HCL iControl is affected by a Session Timeout vulnerability. This flaw could allow an attacker to exploit an unattended or abandoned active session, leading to unauthorized access to the application. Successful exploitation enables the attacker to perform actions on behalf of the victim. No speci...