CVE-2026-104408

The Groundhogg WordPress plugin, affecting versions up to and including 4.8.3 , is susceptible to a Blind SQL Injection vulnerability. The root cause is the Improper Neutralization of Special Elements used in an SQL command. This flaw allows an attacker with high privileges to perform SQL injecti...

CVE-2026-103335

The Video Conferencing with Zoom plugin for WordPress (by Deepen Bajracharya) is vulnerable to a Sensitive Data Exposure issue in versions up to and including 4.6.10 . The vulnerability, classified as CWE-201 , allows for the retrieval of embedded sensitive data from the video-conferencing-with-z...

CVE-2026-105055

The WP Mailster plugin for WordPress, versions up to 1.9.0.0 , is vulnerable to a Broken Access Control issue. This vulnerability stems from missing authorization within the wp-mailster component, which allows for the exploitation of incorrectly configured access control security levels. The vuln...

CVE-2026-103511

Prior to version 2026.4.2 , Perforce P4 Search is vulnerable to an arbitrary file-write flaw. The software fails to validate file names provided to its extension installation feature . An attacker possessing super-user or service-token privileges can exploit this to write files containing arbitra...

CVE-2026-97071

The VillaTheme CURCY (woo-multi-currency) WordPress plugin versions up to and including 2.2.17 is vulnerable to an Incorrect Calculation vulnerability (CWE-682). This flaw allows for Integer Attacks , potentially impacting the integrity of data during currency calculations. No specific exploitati...

CVE-2026-105062

The Brandtoss WP Admin Audit plugin for WordPress (versions n/a through 1.2.17 ) is vulnerable to a Missing Authorization vulnerability (CWE-862). This issue allows for exploiting incorrectly configured access control security levels . The impact is categorized as Medium severity with a CVSS3.1 s...

CVE-2026-103078

The WordPress JS Help Desk plugin (specifically the js-support-ticket component) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw, identified as CWE-639 . This vulnerability allows for an Authorization Bypass due to incorrectly configured access control security levels, enabling a...

CVE-2026-103512

Perforce P4 Search versions prior to 2026.4.2 are vulnerable to an authentication bypass because the system trusts a client-supplied address during the validation of specific authentication requests. An attacker possessing a stolen P4 Server ticket can exploit this flaw to bypass host-based ticke...

CVE-2026-104407

The PowerPress Podcasting plugin for WordPress (versions up to and including 11.17.9 ) is vulnerable to a Cross-Site Request Forgery (CSRF) (CWE-352). This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue has a HIGH base severity (CVSS...

CVE-2026-104811

The Mitel MiVoice Office 400 is vulnerable to remote code execution due to an improper file type validation flaw in the Music on Hold functionality. Located in the web portal on TCP port 443 (Configuration → Services), the application fails to properly restrict uploaded files to the intended WAV ...

CVE-2026-104386

The WP VR (wpvr) plugin for WordPress, versions n/a through 9.1.3 , is affected by a Broken Access Control vulnerability (CWE-862 ). The flaw allows for exploiting incorrectly configured access control security levels due to missing authorization. The impact includes potential changes to confiden...

CVE-2026-104810

Mitel MiVoice Office 400 is affected by a path traversal vulnerability in the web portal (TCP port 443) specifically within the Maintenance → File Management → File Browser section. An authenticated attacker can exploit this flaw to access and delete sensitive files outside the intended directory...

CVE-2026-105069

The Nikki Blight QR Redirector WordPress plugin (versions n/a through 2.0.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored o...

CVE-2026-104809

The Mitel MiVoice Office 400 is vulnerable to a Shared Object Hijacking vulnerability. The issue stems from a loading mechanism that relies on a predictable module name without performing adequate integrity or origin verification. An attacker can place a malicious .so file in the expected path, w...

CVE-2026-104404

The GiveWP (formerly GiveWP give) WordPress plugin, versions n/a through 4.17.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious scripts into the application. The...

CVE-2026-103507

Perforce P4 Search versions prior to 2026.4.2 are vulnerable to an arbitrary file-write flaw because the software fails to restrict file paths through its logging configuration interface . An attacker possessing a service authentication token can write arbitrary files to the host, which may lead ...

CVE-2026-104808

A stored Cross-Site Scripting (XSS) vulnerability exists in the Mitel MiVoice Office 400 web portal. The flaw is located in the "Microsoft Exchange mailbox" field under Configuration → Users → Users List (listening on TCP port 443). The application fails to properly validate or sanitize user-supp...

CVE-2026-105254

A SQL injection vulnerability exists in the itsourcecode Online Admission System 1.0 . The flaw is located within an unspecified function of the /admin/schoolyear.php file, where manipulation of the sy argument allows for remote exploitation. While an exploit is reported as publicly available, sp...

CVE-2026-104807

The Mitel MiVoice Office 400 web portal is vulnerable to a stored Cross-Site Scripting (XSS) flaw (CWE-79). The issue resides in the Configuration → Domains section, specifically within the "Description" field, where the application fails to properly validate or sanitize user-supplied input befor...

CVE-2026-100102

Perforce P4 Search container images prior to version 2026.4.2 are vulnerable to remote code execution due to an unauthenticated Java debug interface (JDWP) being enabled. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, which may lead ...