CVE-2026-65712

CVE-2026-65712 concerns Joomla Extension - regularlabs.com, specifically the Joomla Pro CDN feature. The issue is insecure path handling in the CDN versioning system, which could check file paths outside the site directory, potentially exposing local file existence and modification metadata. The ...

CVE-2026-65756

CVE-2026-65756 affects the Joomla extension Keyboard Shortcuts from regularlabs.com. The issue is an XSS vector where shortcut configuration accepts arbitrary inline JavaScript, allowing potential script execution in the context of the affected extension. Per the published metrics, the attack vec...

CVE-2026-64874

CVE-2026-64874 affects the Joomla extension Cache Cleaner Pro from regularlabs.com. The underlying issue is exposure of CDN credentials in administrator request URLs, enabling credential leakage. The published metrics indicate a CVSS v3.1 base score of 9.8 (CRITICAL) with network access, no user ...

CVE-2026-64799

CVE-2026-64799 affects Joomla extensions from Regular Labs (Articles Anywhere and Users Anywhere). The issue is SSRF via remote image downloads where content-controlled image URLs can touch private or reserved network services, follow unsafe redirects, and save responses without validating they a...

CVE-2026-65430

CVE-2026-65430 affects the Joomla Extension GeoIP by regularlabs.com. The vulnerability is caused by leakage of MaxMind credentials in request URLs, exposing credentials via the extension’s operations. Documents explicitly identify credential leakage in the GeoIP component; no details on affected...

CVE-2026-65431

The CVE describes a ZIP slip in the Joomla GeoIP extension by regularlabs.com. The root cause is that GeoIP database update archives are extracted without path validation, enabling unsafe file extractions. Affected product: Joomla Extension (GeoIP) from regularlabs.com. Documented impact is high ...

CVE-2026-15011

CVE-2026-15011 concerns the WordPress plugin “Customer Support Ticket System & Helpdesk” (up to version 6.0.5). The vulnerability stems from dynamic function invocation on an attacker-controlled value via the public-facing path parameter, with insufficient validation. This allows unauthenticated ...

CVE-2026-14282

The CVE describes a vulnerability in the GoDAM WordPress plugin (versions up to and including 1.12.2) where an insufficient file type validation in save_video_file() (hooked to WPForms process) trusts the attacker-controlled Content-Type header, preserves the original filename via wp_unique_filen...

CVE-2026-14481

The CVE-2026-14481 entry affects the WordPress plugin Equalize Digital Accessibility Checker (versions up to and including 1.46.0). It reports a Stored Cross-Site Scripting (XSS) vulnerability in the html parameter due to insufficient input sanitization and output escaping. The flaw allows authen...

CVE-2026-15794

The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the position shortcode attribute in all versions up to 3.0.9. Authorized attackers with contributor-level access or higher can inject scripts that execute for page visitors. The all_page="1" a...

CVE-2026-15647

Affected software: Brands for WooCommerce (WordPress plugin). Vulnerable component: br_brand_tooltip term meta; root cause: insufficient input sanitization and output escaping. Impact: authenticated attackers with custom-level access can store scripts via term meta, leading to stored XSS when pag...

CVE-2026-15646

The Brands for WooCommerce plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) via the 'style' shortcode attribute in all versions up to and including 3.8.8, due to insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor...

CVE-2026-15906

CVE-2026-15906 affects the WordPress plugin “Premium Packages – Sell Digital Products Securely” up to version 7.0.4. The issue is a generic SQL injection via the orderby parameter caused by insufficient escaping and lack of proper SQL query preparation. This allows authenticated attackers with ad...

CVE-2026-15827

The CWE/CVSS entry CVE-2026-15827 concerns GutenKit Blocks for WordPress, affected up to version 2.4.12. Two REST endpoints (/wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests) register permission_callback => '__return_true' and expose the site’s Mailchim...

CVE-2026-15761

The Tickera WordPress plugin (versions up to 3.6.0.1) is affected by a generic SQL Injection via the tc_event_filter parameter due to insufficient escaping and improper query preparation. The vulnerability is exploitable by authenticated staff+, who gain access via the edit_tc_tickets_instances c...

CVE-2026-16078

CVE-2026-16078 affects the WCPOS

CVE-2026-15404

CVE-2026-15404 concerns the Lpagery WordPress plugin (<= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...

CVE-2026-16723

The vulnerability CVE-2026-16723 affects fastjson 1.2.68–1.2.83. It enables remote code execution under the stock default configuration, with no AutoType enabling or classpath gadget required. The available data specifies the affected versions and that exploitation is possible without specialized...

CVE-2026-52688

Technical details for CVE-2026-52688 are not publicly available in the provided documents; monitor for updates.

CVE-2026-52686

The CVE-2026-52686 entry describes a DNSSEC validation bypass in wildcard proof handling: when a wildcard expansion yields a CNAME or DNAME, NSEC/NSEC3 proofs are accepted without signature validation. This concerns the DNS resolver logic (noted in the PowerDNS advisory) and can bypass proper DNS...