CVE-2026-15827

The CWE/CVSS entry CVE-2026-15827 concerns GutenKit Blocks for WordPress, affected up to version 2.4.12. Two REST endpoints (/wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests) register permission_callback => '__return_true' and expose the site’s Mailchim...

CVE-2026-15404

CVE-2026-15404 concerns the Lpagery WordPress plugin (<= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...

CVE-2026-16078

CVE-2026-16078 affects the WCPOS

CVE-2026-16723

The vulnerability CVE-2026-16723 affects fastjson 1.2.68–1.2.83. It enables remote code execution under the stock default configuration, with no AutoType enabling or classpath gadget required. The available data specifies the affected versions and that exploitation is possible without specialized...

CVE-2026-52688

Technical details for CVE-2026-52688 are not publicly available in the provided documents; monitor for updates.

CVE-2026-52686

The CVE-2026-52686 entry describes a DNSSEC validation bypass in wildcard proof handling: when a wildcard expansion yields a CNAME or DNAME, NSEC/NSEC3 proofs are accepted without signature validation. This concerns the DNS resolver logic (noted in the PowerDNS advisory) and can bypass proper DNS...

CVE-2024-58330

CVE-2024-58330 affects Bosch IP cameras families CPP13 and CPP14 due to a missing authentication check in the access path that guards video analytics event data. The vulnerability enables an unauthenticated attacker to retrieve video analytics event data remotely over the network, with a CVSS v3....

CVE-2024-58023

Technical details are not publicly available in the provided documents. Monitor Bosch security advisories for updates on CVE-2024-58023.

CVE-2026-52684

The CVE-2026-52684 entry describes a vulnerability in the Prefetch feature that can enable a persistent ghost domain cache poisoning attack. Affected scenario occurs when the auth response is very slow and records expire between fetches; TTL capping is not enforced due to lack of data, unlike reg...

CVE-2026-16287

CVE-2026-16287 affects Pardus-update (TÜBİTAK BİLGEM) with OS command injection via offline update. Affected: pardus-update versions before 0.7.0 (starting at 0.6.6). Root cause: improper neutralization of special OS command elements. Impact: high for confidentiality, integrity, and availability;...

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

CVE-2026-9635

The CVE concerns the WP Shortcode by MyThemeShop plugin for WordPress. A stored XSS exists in the [tab] shortcode via the 'title' attribute in versions up to 1.4.17. The root cause is insufficient input sanitization and output escaping in the mts_tabs() function, which directly echoes the title a...

CVE-2026-9729

The CVE-2026-9729 entry concerns the Webpushr Push Notifications plugin for WordPress (versions up to 4.39.0). It describes a Stored Cross-Site Scripting flaw in which unsanitized input from the webpushr_notification_title and webpushr_notification_body parameters is combined into HTML attribute ...

CVE-2026-12421

The ARforms WordPress plugin (affected: all versions up to and including 7.2.1) is vulnerable to Stored Cross-Site Scripting via password field values due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that ...

CVE-2026-59678

CVE-2026-59678 : An reported Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any user to mount/unmount arbitrary file systems and modify network settings via NetworkManager. Affected: PortProtonQt before 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe. Impact includes local pri...

CVE-2026-59677

The CVE-2026-59677 issue is a local vulnerability in SELinux policycoreutils seunshares (up to version 3.10) that permits a user running in an unconfined context to kill root-owned processes also in unconfined context. Documented under PT-2026-61060 as a Local DoS/vector in seunshare, with the af...

CVE-2026-59676

This CVE concerns a TOCTOU race in the seunshare utility of policycoreutils (up to version 3.10) that lets a user in the unconfined SELinux domain delete arbitrary root-owned files. Affected component: seunshare within policycoreutils; root cause: TOCTOU race enabling local file deletion via rm_r...

CVE-2026-9066

The CVE describes a Reflected XSS in WP Compress for WordPress plugin before 7.10.04 due to lack of validation of a query parameter that controls the asset CDN host. This allows an attacker, via a crafted link, to cause the loader to inject script elements pointing to an attacker-controlled origi...

CVE-2026-9577

The Post Status Notifier Lite WordPress plugin (before 1.13.0) is affected. The vulnerability arises because the plugin does not properly escape the mod URL parameter before reflecting it into the admin settings page (admin.php?page=post-status-notifier-lite), enabling a Reflected Cross-Site Scri...

CVE-2026-12082

CVE-2026-12082 affects the Praison AI SEO WordPress plugin prior to version 5.0.7. The root cause is missing authorization checks on several REST API routes, allowing unauthenticated users to: (1) modify the permalink of any published post and (2) read the plugin’s configuration data from before ...