CVE-2026-14322

The Timetics WordPress plugin before 1.0.57 is affected. The vulnerability arises because the plugin does not enforce a pending or unpaid status for new bookings created through a payment method outside its recognised gateways, allowing unauthenticated users to create fully-approved bookings for ...

CVE-2026-12987

The CVE covers the WordPress plugin Events Manager (before 7.3.7). It describes that in No-User-Account Booking Mode, a booking-field supplied by the booker is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. This object-injection c...

CVE-2026-12968

The CVE concerns the WordPress plugin “Product Addons and Product Options With Custom Fields” (before 1.6.15). Affected component is the unauthenticated file-upload endpoint that accepts SVG files, which are stored and served inline. This allows an unauthenticated attacker to upload a malicious S...

CVE-2026-15802

The CVE covers the WP Foodbakery WordPress plugin. Affected: all versions up to 4.9. Vulnerability: arbitrary file deletion due to insufficient validation in delete_locations_backup_file_callback. Impact: authenticated attackers with subscriber-level access can delete arbitrary files on the serve...

CVE-2026-16492

CVE-2026-16492 affects the umijs umi project up to version 4.6.63, specifically the GIT File Helper’s function git.getFileCreateInfo in the file packages/utils/src/getFileGitIno.ts . This manipulation enables an OS command injection, with a public exploit available. A fix is provided in version 4...

CVE-2026-56844

The CVE concerns the Veeam Updater component within the Veeam Software Appliance. It describes a local privilege escalation that could allow a local user to gain root-level access on the underlying OS. The connected documents confirm the affected component and the impact (elevated privileges to r...

CVE-2026-16490

The CVE-2026-16490 vulnerability affects itsourcecode Hospital Management System 1.0, specifically the /prescription.php component. The issue is a SQL injection caused by manipulating the editid parameter, with remote exploitability and a public exploit available. Affected reach, impact details, ...

CVE-2026-63676

The initial CVE-2026-63676 entry is reserved without public details. Connected advisories show that perl-YAML-1.320.0-1.1 for openSUSE Tumbleweed GA media fixes multiple security issues in that package. Public specifics (root cause, affected components, exploit details) are not provided in the do...

CVE-2026-16641

Technical details for CVE-2026-16641 are not publicly available in the provided documents. Connected records mention unrelated entries noting unsupported projects with known security issues. Monitor for updates to obtain concrete details about affected products and remediation.

CVE-2026-16642

Technical details for CVE-2026-16642 are not publicly available in the provided documents. No affected products, root cause, or remediation are stated. Monitor for updates.

CVE-2026-15088

Technical details for CVE-2026-15088 are not publicly available in the provided documents. Monitor for updates.

CVE-2025-50324

CVE-2025-50324 affects Milos Paripovic OneCommander v3.96.0.0. The issue allows a remote attacker to execute arbitrary code via the OneCommander.exe component. CVSS 3.1 base score 8.8 (NETWORK/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Documents do not provide exploitation details or remediation guida...

CVE-2026-16644

Summary: Drupal contributors’ REST endpoints for webforms have insufficient permission checks in the impacted module, enabling potential misuse when an attacker already has REST resource permissions. Affected component: Drupal webform REST sub-system (Drupal contrib module). Root cause: The paren...

CVE-2026-16638

Drupal contrib module for managing Media UI in a folder structure contains a stored XSS vulnerability due to insufficient sanitization of media item and folder names/descriptions in the media browser. Exploitation is limited to users with permission to create/edit media items or folders; no publi...

CVE-2026-16640

Technical details for CVE-2026-16640 are not provided in the supplied documents. No affected products, versions, or impact are disclosed. Monitor for updates from the issuing party.

CVE-2026-16643

Technical details for CVE-2026-16643 are not publicly available in the provided documents. Monitor for updates as the candidate is reserved and no affected products, impact, or fixes are disclosed.

CVE-2025-50330

Vulnerability detail: ZipGenius Team ZipGenius

CVE-2025-50329

CVE-2025-50329 affects ConeXware, Inc. Power Archiver

CVE-2026-16645

The connected OSV/PTSecurity entries describe a vulnerability in the Photoswipe Drupal module where access checks were insufficient when rendering images with the Photoswipe image gallery display formatter. Affects Drupal 8 sites with Photoswipe < 3.0.4 and Drupal 9/10 sites with Photoswipe

CVE-2026-16639

OSV-DRUPAL-CONTRIB-2026-081 describes a vulnerability in a multilingual Drupal module where cross-domain login across language domains can occur if a short-lived token is not properly validated. An attacker could bypass access control and authenticate as a victim user, leveraging automatic cross-...