CVE ID: CVE-2026-36229 Severity: UNKNOWN KEV (actively exploited): NO Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.


CVE ID: CVE-2026-36499 Severity: MEDIUM (CVSS 6.5) CWE: CWE-770 KEV (actively exploited): NO Description: A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads. This can cause a denial of service (DoS) via resource exhaustion.


CVE ID: CVE-2026-11441 Severity: MEDIUM (CVSS 5.3) CWE: CWE-266, CWE-285 KEV (actively exploited): NO Description: A vulnerability was identified in theonedev onedev up to 15.0.5. This vulnerability affects the function canAccessIssue of the file /issues/ of the component Pull Request Handler. Such manipulation of the argument issue leads to improper authorization. It is possible to launch the attack remotely. Upgrading to version 15.0.6 is able to resolve this issue. It is advisable to upgrade the affected component.


CVE ID: CVE-2026-11440 Severity: MEDIUM (CVSS 5.3) CWE: CWE-266, CWE-285 KEV (actively exploited): NO Description: A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the component REST API. This manipulation of the argument project.defaultBranch causes improper authorization. It is possible to initiate the attack remotely. Upgrading to version 15.0.6 is able to mitigate this issue. Upgrading the affected component is advised.


CVE ID: CVE-2026-11439 Severity: MEDIUM (CVSS 5.3) CWE: CWE-266, CWE-285 KEV (actively exploited): NO Description: A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of the component Parent Project Handler. The manipulation of the argument project.parentId results in improper authorization. The attack may be performed from remote. Upgrading to version 15.0.6 can resolve this issue. It is recommended to upgrade the affected component.


CVE ID: CVE-2026-11012 Severity: HIGH (CVSS 8.3) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Serial in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11010 Severity: HIGH (CVSS 8.3) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11009 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11006 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11004 Severity: MEDIUM (CVSS 5.3) CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11002 Severity: CRITICAL (CVSS 9.6) Software: Google Chrome Exploit available: NO KEV: NO Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11438 Severity: MEDIUM (CVSS 5.3) CWE: CWE-266, CWE-285 KEV (actively exploited): NO Description: A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /projects. The manipulation of the argument project.forkedFromId leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 15.0.6 addresses this issue. Upgrading the affected component is recommended.


CVE ID: CVE-2026-11437 Severity: MEDIUM (CVSS 5.5) CWE: CWE-918 KEV (actively exploited): NO Description: A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


CVE: CVE-2026-11001 Severity: MEDIUM (CVSS 6.5) Software: Google Chrome Exploit available: NO KEV: NO Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10999 Severity: MEDIUM (CVSS 6.5) Software: Google Chrome Exploit available: NO KEV: NO Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10994 Severity: MEDIUM (CVSS 6.5) Software: Google Chrome Exploit available: NO KEV: NO Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10993 Severity: MEDIUM (CVSS 6.5) Software: Google Chrome Exploit available: NO KEV: NO Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10992 Severity: MEDIUM (CVSS 6.5) Software: Google Chrome Exploit available: NO KEV: NO Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10990 Severity: CRITICAL (CVSS 9.6) Software: Google Chrome Exploit available: NO KEV: NO Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11436 Severity: LOW (CVSS 2.1) CWE: CWE-79, CWE-94 KEV (actively exploited): NO Description: A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mage_ai/frontend/components/Sessions/SignForm/index.tsx of the component Sign-in Flow. Performing a manipulation of the argument query.redirect_url results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2026-11435 Severity: MEDIUM (CVSS 5.5) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipulation of the argument httpOID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2026-11434 Severity: LOW (CVSS 1.9) CWE: CWE-79, CWE-94 KEV (actively exploited): NO Description: A weakness has been identified in FluentCMS 0.0.5. The impacted element is an unknown function of the file /admin/blocks of the component Blocks Plugin. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2026-11413 Severity: HIGH (CVSS 7.4) CWE: CWE-119, CWE-121 KEV (actively exploited): NO Description: A security vulnerability has been detected in JingDong JD Cloud Box AX6600 4.5.3.r4546. The impacted element is the function set_macfilter of the file /sbin/jdcweb_rpc. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2026-11211 Severity: HIGH (CVSS 8.8) CWE: CWE-472 KEV (actively exploited): NO Description: Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows

CVE: CVE-2026-11199 Severity: MEDIUM (CVSS 5.9) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to leak cross-origin data via malicious network traffic. (Chromium security severity: Medium)


CVE ID: CVE-2026-11103 Severity: HIGH (CVSS 7.8) CWE: CWE-269 KEV (actively exploited): NO Description: Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)


CVE ID: CVE-2026-11072 Severity: HIGH (CVSS 7.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: Medium)


CVE: CVE-2026-10971 Severity: CRITICAL (CVSS 9.6) Software: Google Chrome, Microsoft Windows Exploit available: NO KEV: NO Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-11229 Severity: MEDIUM (CVSS 6.1) CWE: CWE-269 KEV (actively exploited): NO Description: Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via physical access to the device. (Chromium security severity: Low)


CVE ID: CVE-2026-10725 Severity: UNKNOWN CWE: CWE-409 KEV (actively exploited): NO Description: Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb"). The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since version 1.12) every CONTINUATION frame to the per-stream buffer unbounded. MAX_HEADER_LIST_SIZE (default 65536) is advertised in SETTINGS but never consulted on decode. It is absent from the decoder and from the :limits export tag.


CVE ID: CVE-2026-11412 Severity: LOW (CVSS 2.1) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A weakness has been identified in Jinher OA C6. The affected element is an unknown function of the file /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx. Executing a manipulation of the argument queryID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2026-11411 Severity: LOW (CVSS 1.9) CWE: CWE-22 KEV (actively exploited): NO Description: A security flaw has been discovered in iAI Lab PDF AI App 4.21.0 on Android. Impacted is the function getExternalCacheDir of the component chatpdf.pro. Performing a manipulation of the argument _display_name results in path traversal. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2026-11408 Severity: LOW (CVSS 2.1) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The name of the patch is 805d82e7100d49b79b3beb1b9420e8e458987198. It is best practice to apply a patch to resolve this issue.


CVE ID: CVE-2026-11406 Severity: LOW (CVSS 2.1) CWE: CWE-74, CWE-77 KEV (actively exploited): NO Description: A vulnerability was determined in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 4.9.0_beta3-1012-0513-1778656146 is able to resolve this issue. You should upgrade the affected component. The vendor confirms: "This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files."


CVE ID: CVE-2026-7402 Severity: HIGH (CVSS 8.1) CWE: CWE-799 KEV (actively exploited): NO Description: Improper Control of Interaction Frequency vulnerability in MeWare Software Development Inc. PDKS allows Flooding. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.


CVE ID: CVE-2026-7399 Severity: HIGH (CVSS 8.1) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc. PDKS allows Privilege Abuse. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.


CVE ID: CVE-2026-7382 Severity: MEDIUM (CVSS 6.5) CWE: CWE-200, CWE-359 KEV (actively exploited): NO Description: Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc. PDKS allows Excavation. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.


CVE ID: CVE-2026-6849 Severity: HIGH (CVSS 8.8) CWE: CWE-78 KEV (actively exploited): NO Description: Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection. This issue affects Pardus OS My Computer: from <=0.7.5 before 0.8.0.


CVE ID: CVE-2026-5166 Severity: CRITICAL (CVSS 9.6) CWE: CWE-22 KEV (actively exploited): NO Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Path Traversal. This issue affects Pardus Software Center: before 0.6.4.


CVE ID: CVE-2026-5161 Severity: HIGH (CVSS 8.8) CWE: CWE-59 KEV (actively exploited): NO Description: Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack. This issue affects Pardus About: before 1.2.2.


CVE ID: CVE-2026-5141 Severity: HIGH (CVSS 8.8) CWE: CWE-266, CWE-269, CWE-284 KEV (actively exploited): NO Description: Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process. This issue affects Pardus Software Center: from 1.0.2 before 1.0.3.


CVE ID: CVE-2026-5140 Severity: HIGH (CVSS 8.8) CWE: CWE-93 KEV (actively exploited): NO Description: Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Authentication Bypass. This issue affects Pardus Update: from 0.6.3 before 0.6.4.


CVE ID: CVE-2026-3120 Severity: HIGH (CVSS 7.2) CWE: CWE-94 KEV (actively exploited): NO Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allows OS Command Injection. This issue affects SambaBox: from 5.1 before 5.3.


CVE: CVE-2026-2624 Severity: CRITICAL (CVSS 9.8) Software: Epati Antikor Next Generation Firewall Exploit available: NO KEV: NO Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentication Bypass. This issue affects Antikor Next Generation Firewall (NGFW): from v.2.0.1298 before v.2.0.1301.


CVE ID: CVE-2026-2339 Severity: HIGH (CVSS 7.5) CWE: CWE-306 KEV (actively exploited): NO Description: Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion, Privilege Abuse, Command Injection. This issue affects Liderahenk: before 3.5.1.


CVE ID: CVE-2026-1819 Severity: HIGH (CVSS 8.8) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Karel Electronics Industry and Trade Inc. ViPort allows Stored XSS. This issue affects ViPort: through 23012026.


CVE: CVE-2026-1619 Severity: HIGH (CVSS 8.3) Software: Uni-Yaz Flexcity Exploit available: NO KEV: NO Authorization Bypass Through User-Controlled Key vulnerability in Universal Software Inc. FlexCity/Kiosk allows Exploitation of Trusted Identifiers. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.


CVE: CVE-2026-1618 Severity: HIGH (CVSS 8.8) Software: Uni-Yaz Flexcity Exploit available: NO KEV: NO Authentication Bypass Using an Alternate Path or Channel vulnerability in Universal Software Inc. FlexCity/Kiosk allows Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.


CVE ID: CVE-2025-2413 Severity: HIGH (CVSS 8.6) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass. This issue affects ProKuafor: from s1.02.08 before v1.02.08.


CVE ID: CVE-2025-2412 Severity: HIGH (CVSS 8.6) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows Authentication Bypass. This issue affects QR Menu: from s1.05.07 before v1.05.12.


CVE ID: CVE-2025-2411 Severity: HIGH (CVSS 8.6) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano allows Authentication Bypass. This issue affects TaskPano: from s1.06.04 before v1.06.06.


CVE ID: CVE-2025-2406 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi allows Cross-Site Scripting (XSS). This issue affects Trizbi: before 2.144.4.


CVE ID: CVE-2025-2405 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Titarus allows Cross-Site Scripting (XSS). This issue affects Titarus: before 2.144.4.


CVE ID: CVE-2025-2404 Severity: MEDIUM (CVSS 4.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting (XSS). This issue affects STOYS: from 2 before 20250916.


CVE ID: CVE-2025-2311 Severity: CRITICAL (CVSS 9.0) CWE: CWE-319, CWE-522, CWE-648 KEV (actively exploited): NO Description: Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event Monitoring. This issue affects SecHard: before 3.3.0.20220411.


CVE ID: CVE-2025-2307 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Aidango allows Cross-Site Scripting (XSS). This issue affects Aidango: before 2.144.4.


CVE ID: CVE-2025-2301 Severity: MEDIUM (CVSS 4.4) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This issue affects Online Exam Registration: before 14.03.2025.


CVE ID: CVE-2025-2204 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tapandsign Technologies Software Inc. Tap&Sign allows Cross-Site Scripting (XSS). This issue affects Tap&Sign: through 23012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-2155 Severity: HIGH (CVSS 8.8) CWE: CWE-434 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025.


CVE ID: CVE-2025-2154 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Stored XSS. This issue affects Specto CM: before 17032025.


CVE ID: CVE-2025-1929 Severity: HIGH (CVSS 7.2) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Risk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine ve Risk Yönetimi Yazılımı allows SQL Injection, CAPEC - 7 - Blind SQL Injection. This issue affects Reel Sektör Hazine ve Risk Yönetimi Yazılımı: through 1.0.0.4.


CVE: CVE-2025-1928 Severity: CRITICAL (CVSS 9.1) Software: Restajet Online Food Delivery System Exploit available: NO KEV: NO Improper Restriction of Excessive Authentication Attempts vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Password Recovery Exploitation. This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE: CVE-2025-1927 Severity: HIGH (CVSS 7.1) Software: Restajet Online Food Delivery System Exploit available: NO KEV: NO Cross-Site Request Forgery (CSRF) vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Cross Site Request Forgery. This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE: CVE-2025-1885 Severity: MEDIUM (CVSS 5.4) Software: Restajet Online Food Delivery System Exploit available: NO KEV: NO URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Phishing, Forceful Browsing. This issue affects Online Food Delivery System: through 19122025. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-1740 Severity: CRITICAL (CVSS 9.8) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force. This issue affects MyRezzta: from s2.03.01 before v2.05.01.


CVE ID: CVE-2025-1496 Severity: MEDIUM (CVSS 6.5) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authentication Abuse. This issue affects Coslat Hotspot: before 6.26.0.R.20250227.


CVE ID: CVE-2025-1469 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 11.03.2025.


CVE ID: CVE-2025-1395 Severity: HIGH (CVSS 8.2) CWE: CWE-209 KEV (actively exploited): NO Description: Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for application mapping. This issue affects HeyGarson: through 30012026. NOTE: The vendor was contacted several times to verifying fixing process but did not respond in any way.


CVE: CVE-2025-1301 Severity: MEDIUM (CVSS 6.1) Software: Yordam Library Automation System Exploit available: NO KEV: NO Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yordam Informatics Library Automation System allows Reflected XSS. This issue affects Library Automation System: before 21.6.


CVE ID: CVE-2025-1269 Severity: MEDIUM (CVSS 4.8) CWE: CWE-601 KEV (actively exploited): NO Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. This issue affects Liman MYS: before 2.1.1 - 1010.


CVE ID: CVE-2025-1161 Severity: HIGH (CVSS 7.1) CWE: CWE-648 KEV (actively exploited): NO Description: Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue affects Nomysem: through May 2025.


CVE ID: CVE-2025-1035 Severity: MEDIUM (CVSS 5.7) CWE: CWE-22 KEV (actively exploited): NO Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog Server allows Manipulating Web Input to File System Calls. This issue affects KLog Server: before 3.1.1.


CVE: CVE-2025-1031 Severity: HIGH (CVSS 7.5) Software: Utarit Soliclub Exploit available: NO KEV: NO Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse. This issue affects SoliClub: from 5.2.4 before 5.3.7.


CVE: CVE-2025-1030 Severity: HIGH (CVSS 7.5) Software: Utarit Soliclub Exploit available: NO KEV: NO Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Utarit Informatics Services Inc. SoliClub allows Query System for Information. This issue affects SoliClub: from 5.2.4 before 5.3.7.


CVE: CVE-2025-1029 Severity: HIGH (CVSS 7.5) Software: Utarit Soliclub Exploit available: NO KEV: NO Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc. SoliClub allows Read Sensitive Constants Within an Executable. This issue affects SoliClub: from 5.2.4 before 5.3.7.


CVE ID: CVE-2025-0987 Severity: CRITICAL (CVSS 9.9) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection. This issue affects CVLand: from 2.1.0 through 20251103. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-0984 Severity: HIGH (CVSS 8.2) CWE: CWE-434, CWE-79 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection. This issue affects E-Flow: before 3.23.00.


CVE ID: CVE-2025-0879 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shopside Software Shopside App allows Cross-Site Scripting (XSS). This issue requires high privileges. This issue affects Shopside App: before 17.02.2025.


CVE ID: CVE-2025-0878 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XSS). This issue affects LimonDesk: from s1.02.14 before v1.02.17.


CVE ID: CVE-2025-0877 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management System allows Cross-Site Scripting (XSS). This issue affects Reservation Management System: before 4.2.3.


CVE ID: CVE-2025-0876 Severity: MEDIUM (CVSS 4.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies Trade Inc. IT's Workif allows Cross-Site Scripting (XSS). This issue affects IT's Workif: through 20251003. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-0875 Severity: MEDIUM (CVSS 6.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Parameter Injection. This issue affects OBS (Student Affairs Information System): before v26.0328.


CVE ID: CVE-2025-0670 Severity: MEDIUM (CVSS 4.7) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft ProKuafor allows Resource Leak Exposure. This issue affects ProKuafor: from s1.02.07 before v1.02.08.


CVE ID: CVE-2025-0645 Severity: HIGH (CVSS 7.2) CWE: CWE-434 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Pyxis Signage: through 31012025.


CVE ID: CVE-2025-0643 Severity: HIGH (CVSS 7.2) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Narkom Communication and Software Technologies Trade Ltd. Co. Pyxis Signage allows Stored XSS. This issue affects Pyxis Signage: through 31012025.


CVE ID: CVE-2025-0642 Severity: MEDIUM (CVSS 6.3) CWE: CWE-639, CWE-798 KEV (actively exploited): NO Description: Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allows Excavation, Authentication Bypass. This issue affects Assist: through 10.02.2025.


CVE ID: CVE-2025-0640 Severity: MEDIUM (CVSS 4.7) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure. This issue affects OctoCloud: from s1.09.02 before v1.11.01.


CVE ID: CVE-2025-0616 Severity: HIGH (CVSS 8.2) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Ltd. B2B - Netsis Panel allows SQL Injection. This issue affects B2B - Netsis Panel: through 20251003. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-0610 Severity: HIGH (CVSS 8.6) CWE: CWE-352 KEV (actively exploited): NO Description: Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request Forgery. This issue affects QR Menü: from s1.05.06 before v1.05.12.


CVE ID: CVE-2025-0609 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Logo Software Inc. Logo Cloud allows Cross-Site Scripting (XSS). This issue affects Logo Cloud: before 1.18.


CVE ID: CVE-2025-0608 Severity: MEDIUM (CVSS 5.5) CWE: CWE-601 KEV (actively exploited): NO Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing. This issue affects Logo Cloud: before 2025.R6.


CVE ID: CVE-2025-0607 Severity: MEDIUM (CVSS 4.3) CWE: CWE-116 KEV (actively exploited): NO Description: Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing. This issue affects Logo Cloud: before 2.57.


CVE ID: CVE-2025-0606 Severity: MEDIUM (CVSS 6.0) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure. This issue affects Logo Cloud: before 0.67.


CVE ID: CVE-2025-0603 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection. This issue affects Callvision Emergency Code: before V3.0.


CVE ID: CVE-2025-0547 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Bizmu allows Cross-Site Scripting (XSS). This issue affects Bizmu: from 2.27.0 through 20250212.


CVE ID: CVE-2025-0546 Severity: MEDIUM (CVSS 4.7) CWE: CWE-1021, CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or Frames vulnerability in Mevzuattr Software MevzuatTR allows Phishing, iFrame Overlay, Clickjacking, Forceful Browsing. This issue needs high privileges. This issue affects MevzuatTR: before 12.02.2025.


CVE ID: CVE-2025-0545 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-Site Scripting (XSS). This issue affects T-Soft E-Commerce: before v5.


CVE ID: CVE-2025-0421 Severity: MEDIUM (CVSS 4.7) CWE: CWE-1021 KEV (actively exploited): NO Description: Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. This issue affects Shopside: through 05022025.


CVE ID: CVE-2025-0420 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting (XSS). This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204.


CVE ID: CVE-2025-0419 Severity: MEDIUM (CVSS 4.7) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. Zirve Nova allows Cross-Site Scripting (XSS). This issue affects Zirve Nova: from 235 through 20250131.


CVE ID: CVE-2026-50589 Severity: MEDIUM (CVSS 5.3) CWE: CWE-770 KEV (actively exploited): NO Description: In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.


CVE ID: CVE-2026-10879 Severity: UNKNOWN CWE: CWE-787 KEV (actively exploited): NO Description: DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.


CVE: CVE-2025-2812 Severity: CRITICAL (CVSS 9.8) Software: Mydata Ticket Sales Automation Exploit available: YES KEV: NO Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind SQL Injection. This issue affects Ticket Sales Automation: before 03.04.2025 (DD.MM.YYYY).


CVE: CVE-2025-2488 Severity: MEDIUM (CVSS 6.1) Software: Felisify Sambabox Exploit available: NO KEV: NO Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Profelis Informatics SambaBox allows Cross-Site Scripting (XSS). This issue affects SambaBox: before 5.1.


CVE: CVE-2025-2421 Severity: CRITICAL (CVSS 9.8) Software: Felisify Sambabox Exploit available: NO KEV: NO Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Informatics SambaBox allows Code Injection. This issue affects SambaBox: before 5.1.


CVE ID: CVE-2025-2417 Severity: HIGH (CVSS 8.6) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft e-Mutabakat allows Authentication Bypass. This issue affects e-Mutabakat: from 2.02.06 before v2.02.06.


CVE ID: CVE-2025-2416 Severity: HIGH (CVSS 8.6) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass. This issue affects LimonDesk: from s1.02.14 before v1.02.17.


CVE ID: CVE-2025-2415 Severity: HIGH (CVSS 8.6) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass. This issue affects MyRezzta: from s2.03.01 before v2.05.01.


CVE ID: CVE-2025-2414 Severity: HIGH (CVSS 8.6) CWE: CWE-307 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass. This issue affects OctoCloud: from s1.09.03 before v1.11.01.


CVE ID: CVE-2026-9851 Severity: HIGH (CVSS 7.2) CWE: CWE-639 KEV (actively exploited): NO Description: The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.


CVE ID: CVE-2026-9829 Severity: MEDIUM (CVSS 6.5) CWE: CWE-89 KEV (actively exploited): NO Description: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler — accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter — and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.


CVE ID: CVE-2026-9594 Severity: MEDIUM (CVSS 4.4) CWE: CWE-79 KEV (actively exploited): NO Description: The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location_messages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmp_manage_location capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen.


CVE ID: CVE-2026-9016 Severity: MEDIUM (CVSS 5.3) CWE: CWE-117 KEV (actively exploited): NO Description: The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for Logs in all versions up to, and including, 2.5.0. This is due to the `log_js_errors()` AJAX handler being registered for unauthenticated users via `wp_ajax_nopriv_log_js_errors` and gated only by a nonce that is publicly disclosed in every front-end page's HTML through `wp_localize_script()` whenever JavaScript error logging is enabled, providing no real authorization barrier. This makes it possible for unauthenticated attackers to inject arbitrary forged entries into the site's WordPress debug log by supplying attacker-controlled values for the `message`, `script`, `lineNo`, `columnNo`, and `pageUrl` fields — enabling spoofing of error and incident records, obscuring malicious activity within fabricated log noise, and misleading administrators who rely on the log for triage. This vulnerability is only exploitable when the plugin's JavaScript error logging feature is enabled, as the requisite nonce is only published into the page HTML under that condition.


CVE ID: CVE-2026-8839 Severity: MEDIUM (CVSS 5.3) CWE: CWE-639 KEV (actively exploited): NO Description: The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via `Mappress_Api::rest_api_init()`, where the GET `/wp-json/mapp/v1/maps/{mapid}` endpoint uses `'permission_callback' => '__return_true'` and the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only check the generic `edit_posts` capability without confirming that the requester owns the targeted map — a gap that is not compensated at the model layer, as `Mappress_Map::get()`, `save()`, `delete()`, `mutate()`, and `empty_trash()` all operate on any caller-supplied map ID without an ownership check. This makes it possible for unauthenticated attackers to read sensitive map data — including POI titles, addresses, coordinates, and body content — for any map on the site by enumerating map IDs, and for authenticated attackers with Contributor-level access and above to modify, delete, trash/restore, or clone any map regardless of its author.


CVE ID: CVE-2026-8611 Severity: MEDIUM (CVSS 4.3) CWE: CWE-639 KEV (actively exploited): NO Description: The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoice_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to download arbitrary customer invoices by enumerating sequential post IDs, exposing sensitive billing PII including full name, email address, phone number, order total, line items, and customer notes belonging to other customers.


CVE ID: CVE-2026-7624 Severity: MEDIUM (CVSS 4.3) CWE: CWE-862 KEV (actively exploited): NO Description: The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to invoke privileged state-changing Squirrly cloud API operations, such as revoking the site's Google Search Console and Google Analytics integrations via `api/gsc/revoke` and `api/ga/revoke`, that are otherwise restricted to administrator-level users holding the `sq_manage_settings` capability.


CVE ID: CVE-2026-11150 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11148 Severity: MEDIUM (CVSS 6.5) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11146 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11145 Severity: MEDIUM (CVSS 6.5) CWE: CWE-362 KEV (actively exploited): NO Description: Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11144 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted video file. (Chromium security severity: Medium)


CVE ID: CVE-2026-11143 Severity: MEDIUM (CVSS 6.5) CWE: CWE-122 KEV (actively exploited): NO Description: Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)


CVE ID: CVE-2026-11142 Severity: MEDIUM (CVSS 6.5) CWE: CWE-639 KEV (actively exploited): NO Description: Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11141 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11140 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 KEV (actively exploited): NO Description: Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11139 Severity: MEDIUM (CVSS 6.5) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11138 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11137 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11135 Severity: MEDIUM (CVSS 6.5) CWE: CWE-284 KEV (actively exploited): NO Description: Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11134 Severity: MEDIUM (CVSS 6.5) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11133 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 KEV (actively exploited): NO Description: Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11132 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 KEV (actively exploited): NO Description: Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11131 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11129 Severity: MEDIUM (CVSS 6.5) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11119 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11116 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Medium)


CVE ID: CVE-2026-11115 Severity: HIGH (CVSS 7.3) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)


CVE ID: CVE-2026-9280 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Parameters in iframe Mode in all versions up to, and including, 2.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that iframe mode (AI_OPTION_IFRAME) is enabled on at least one ad block displayed on the targeted page, which is a non-default but supported configuration commonly used for AdSense and JavaScript-based ads.


CVE ID: CVE-2026-9197 Severity: MEDIUM (CVSS 4.9) CWE: CWE-22 KEV (actively exploited): NO Description: The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.


CVE ID: CVE-2026-8991 Severity: MEDIUM (CVSS 4.4) CWE: CWE-79 KEV (actively exploited): NO Description: The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings in all versions up to, and including, 1.3.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


CVE ID: CVE-2026-8978 Severity: MEDIUM (CVSS 4.9) CWE: CWE-89 KEV (actively exploited): NO Description: The OptinCraft – Drag & Drop Optins & Popup Builder for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


CVE ID: CVE-2026-8502 Severity: MEDIUM (CVSS 5.3) CWE: CWE-862 KEV (actively exploited): NO Description: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'return_type' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the plaintext post_password of password-protected courses and the full post_content, post_author, and post_name of unpublished draft, private, and pending courses via the unrestricted SELECT * fallback query. Exploitation requires supplying both c_status=all (to bypass the publish-only post_status WHERE clause) and return_type=json (to prevent the safe DISTINCT(ID) AS ID field override) in a single unauthenticated request to the /wp-json/lp/v1/courses/archive-course endpoint.


CVE ID: CVE-2026-7796 Severity: MEDIUM (CVSS 6.4) CWE: CWE-79 KEV (actively exploited): NO Description: The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page


CVE ID: CVE-2026-7795 Severity: MEDIUM (CVSS 6.4) CWE: CWE-79 KEV (actively exploited): NO Description: The Click to Chat – WA Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [chat] shortcode 'num' parameter in all versions up to, and including, 4.38. This is due to insufficient escaping when embedding user-supplied shortcode attribute values inside JavaScript string literals that are then placed in HTML event-handler attributes. The CCW_Shortcode::shortcode() function applies esc_attr() to the 'num' parameter (line 157), which converts single quotes to the HTML entity '. This entity-encoded value is then interpolated directly into a JavaScript window.open() call string delimited by single quotes (line 194/221), and that complete string is placed verbatim into an HTML onclick attribute in the style template files (e.g., sc-style-1.php line 6). Because browsers HTML-decode event attribute values before executing the embedded JavaScript, the ' entities are decoded back to literal single quotes at runtime, allowing the injected payload to break out of the JavaScript string context and execute arbitrary code. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user clicks the WhatsApp chat button rendered by the [chat] shortcode.


CVE ID: CVE-2026-7792 Severity: MEDIUM (CVSS 5.3) CWE: CWE-345 KEV (actively exploited): NO Description: The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to and including 1.10.0.1. This is due to the PayPal Commerce webhook endpoint processing unauthenticated JSON webhook payloads without verifying that the request originated from PayPal using the required HMAC-SHA256 webhook signature, and only checking whether the supplied event_type is whitelisted before dispatching the attacker-controlled resource data to handlers that update payment records. This makes it possible for unauthenticated attackers who know a valid PayPal subscription_id to forge PayPal webhook events and modify subscription payment records, such as reactivating a cancelled or suspended subscription by setting its subscription_status to active.


CVE ID: CVE-2026-7665 Severity: MEDIUM (CVSS 5.3) CWE: CWE-639 KEV (actively exploited): NO Description: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.6.4 via the ajax_load_more function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.


CVE ID: CVE-2026-7566 Severity: MEDIUM (CVSS 6.6) CWE: CWE-502 KEV (actively exploited): NO Description: The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.


CVE ID: CVE-2026-7565 Severity: MEDIUM (CVSS 4.9) CWE: CWE-22 KEV (actively exploited): NO Description: The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including, 4.1.4 via the 'import-user-file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.


CVE ID: CVE-2026-7537 Severity: HIGH (CVSS 7.2) CWE: CWE-434 KEV (actively exploited): NO Description: The MDJM Event Management plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.7.8.3 via the mdjm_send_comm_email function. This is due to no file type, extension, or MIME type validation being performed on uploaded files. This makes it possible for authenticated attackers, with administrator-level access and above, to upload files that may be executable, which makes remote code execution possible.


CVE ID: CVE-2026-2500 Severity: MEDIUM (CVSS 4.4) CWE: CWE-22 KEV (actively exploited): NO Description: The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as `wp-config.php` or `/etc/passwd`, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the `is_qckply_clone` option is set) or when running on `playground.wordpress.net`.


CVE ID: CVE-2026-11114 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Device Trust in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11113 Severity: CRITICAL (CVSS 9.6) Software: Google Chrome Exploit available: NO KEV: NO Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11112 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)


CVE ID: CVE-2026-11111 Severity: HIGH (CVSS 8.1) CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11110 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11109 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11108 Severity: HIGH (CVSS 8.8) CWE: CWE-269 KEV (actively exploited): NO Description: Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11107 Severity: MEDIUM (CVSS 4.3) CWE: CWE-451 KEV (actively exploited): NO Description: Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11106 Severity: MEDIUM (CVSS 6.5) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11105 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11104 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11102 Severity: HIGH (CVSS 8.8) Software: Google Chrome Exploit available: NO KEV: NO Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)


CVE ID: CVE-2026-11101 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11100 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11098 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-11097 Severity: MEDIUM (CVSS 6.5) CWE: CWE-474 KEV (actively exploited): NO Description: Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10973 Severity: HIGH (CVSS 7.4) Software: Google Chrome Exploit available: NO KEV: NO Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10972 Severity: CRITICAL (CVSS 9.6) Software: Google Chrome, Linux Linux Kernel Exploit available: NO KEV: NO Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10968 Severity: HIGH (CVSS 7.4) Software: Google Chrome, Microsoft Windows Exploit available: NO KEV: NO Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10966 Severity: CRITICAL (CVSS 9.6) Software: Google Chrome Exploit available: NO KEV: NO Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)


CVE ID: CVE-2026-10955 Severity: HIGH (CVSS 8.8) CWE: CWE-843 KEV (actively exploited): NO Description: Type Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)


CVE ID: CVE-2026-9281 Severity: MEDIUM (CVSS 6.4) CWE: CWE-79 KEV (actively exploited): NO Description: The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jtlma_custom_js' Page Setting (Custom JS Extension) in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unfiltered_html capability check is only enforced during Elementor control registration (UI rendering) and not during the save process, enabling Author-level users to inject the jtlma_custom_js setting directly via a crafted POST request to admin-ajax.php?action=elementor_ajax, bypassing the UI-level restriction entirely.


CVE ID: CVE-2026-9008 Severity: MEDIUM (CVSS 4.3) CWE: CWE-862 KEV (actively exploited): NO Description: The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist_unqprfx_ext_shortcode() function (the [pagelist_ext] / [pagelistext] shortcode) accepting attacker-controlled post_status, post_type, and show_meta_key attributes and passing them directly into get_pages() and get_post_meta() with no capability check verifying that the rendering user is permitted to read the matched objects. When the current post has no child pages, the shortcode re-issues the query with child_of => 0, broadening it to every page on the site matching the supplied status/type. This makes it possible for authenticated attackers, with contributor-level access and above, to disclose the titles, body content/excerpts, and arbitrary post meta of unrelated private and draft pages by inserting the shortcode into a contributor-authored draft and previewing it.


CVE ID: CVE-2026-8901 Severity: HIGH (CVSS 7.2) CWE: CWE-79 KEV (actively exploited): NO Description: The Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Submission Data in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes when a CRM API call fails for the submitted form and an administrator subsequently views the error log details modal in the WordPress admin panel.


CVE ID: CVE-2026-8438 Severity: HIGH (CVSS 7.2) CWE: CWE-79 KEV (actively exploited): NO Description: The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads into literal HTML characters. This decoded, unsanitized value is concatenated directly into a debug log message and stored in the database. When an administrator navigates to the AIOS Dashboard Debug Logs page, the column_default() method returns the raw database value without escaping, and the parent list table echoes it directly, causing JavaScript execution in the administrator's browser session. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page, enabling nonce theft, privileged AJAX/REST actions, and potential full site compromise.


CVE: CVE-2026-21017 Severity: MEDIUM (CVSS 4.6) Software: Samsung Android Exploit available: NO KEV: NO Improper handling of insufficient privileges in SecTelephonyProvider prior to SMR Jun-2026 Release 1 allows local attackers to access privileged files.


CVE: CVE-2026-21025 Severity: MEDIUM (CVSS 6.9) Software: Samsung Android Exploit available: NO KEV: NO Incorrect privilege assignment in Telephony prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.


CVE: CVE-2026-21026 Severity: MEDIUM (CVSS 6.4) Software: Samsung Android Exploit available: NO KEV: NO Improper export of android application components in SpriteWallpaper prior to SMR Jun-2026 Release 1 allows local attackers to access to sensitive information.


CVE: CVE-2026-21027 Severity: MEDIUM (CVSS 4.8) Software: Samsung Android Exploit available: NO KEV: NO Improper export of android application components in ImsSettings prior to SMR Jun-2026 Release 1 allows local attackers to trigger logging function.


CVE: CVE-2026-21028 Severity: MEDIUM (CVSS 5.1) Software: Samsung Android Exploit available: NO KEV: NO Improper access control in AuditLogService prior to SMR Jun-2026 Release 1 allows local attackers to access sensitive information.


CVE: CVE-2026-21029 Severity: MEDIUM (CVSS 6.8) Software: Samsung Android Exploit available: NO KEV: NO Improper export of android application components in Galaxy Editing Service prior to SMR Jun-2026 Release 1 allows local attacker to execute privileged operations.


CVE: CVE-2026-21030 Severity: MEDIUM (CVSS 6.4) Software: Samsung Android Exploit available: NO KEV: NO Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.


CVE: CVE-2026-21031 Severity: MEDIUM (CVSS 5.2) Software: Samsung Android Exploit available: NO KEV: NO Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.


CVE: CVE-2026-11204 Severity: MEDIUM (CVSS 6.5) Software: Apple Iphone Os, Google Chrome Exploit available: NO KEV: NO Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11206 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11207 Severity: CRITICAL (CVSS 9.6) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)


CVE: CVE-2026-11208 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11209 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11210 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted RAR file. (Chromium security severity: Medium)


CVE: CVE-2026-11212 Severity: MEDIUM (CVSS 4.3) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)


CVE: CVE-2026-11225 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Low)


CVE: CVE-2026-11226 Severity: MEDIUM (CVSS 6.5) Software: Google Android, Google Chrome Exploit available: NO KEV: NO Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)


CVE: CVE-2026-11227 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Low)


CVE: CVE-2026-10939 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10958 Severity: HIGH (CVSS 8.8) Software: Apple Iphone Os, Google Chrome Exploit available: NO KEV: NO Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10959 Severity: HIGH (CVSS 8.8) Software: Google Android, Google Chrome Exploit available: NO KEV: NO Use after free in Input in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-11003 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10998 Severity: MEDIUM (CVSS 4.0) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bounds memory read via malicious network traffic. (Chromium security severity: Medium)


CVE: CVE-2026-10997 Severity: MEDIUM (CVSS 6.5) Software: Google Chrome Exploit available: NO KEV: NO Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)


CVE: CVE-2026-10996 Severity: MEDIUM (CVSS 6.5) Software: Google Chrome Exploit available: NO KEV: NO Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10995 Severity: HIGH (CVSS 8.8) Software: Google Chrome Exploit available: NO KEV: NO Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10991 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-10989 Severity: HIGH (CVSS 8.8) Software: Google Chrome Exploit available: NO KEV: NO Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10988 Severity: HIGH (CVSS 8.8) Software: Google Chrome Exploit available: NO KEV: NO Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10987 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10986 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Integer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: High)


CVE: CVE-2026-10982 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in WebXR in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10978 Severity: HIGH (CVSS 8.8) Software: Google Chrome, Microsoft Windows Exploit available: NO KEV: NO Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)


CVE: CVE-2026-10975 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10967 Severity: HIGH (CVSS 8.3) Software: Google Android, Google Chrome Exploit available: NO KEV: NO Use after free in SurfaceCapture in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10961 Severity: HIGH (CVSS 8.3) Software: Apple Iphone Os, Google Chrome Exploit available: NO KEV: NO Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10912 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10916 Severity: MEDIUM (CVSS 6.1) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)


CVE: CVE-2026-10923 Severity: HIGH (CVSS 8.8) Software: Google Android, Google Chrome Exploit available: NO KEV: NO Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: High)


CVE: CVE-2026-11187 Severity: MEDIUM (CVSS 6.3) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Inappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11186 Severity: MEDIUM (CVSS 6.1) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11184 Severity: MEDIUM (CVSS 6.3) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11183 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Out of bounds read in GWP-ASan in Google Chrome prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)


CVE: CVE-2026-11120 Severity: CRITICAL (CVSS 9.6) Software: Google Chrome Exploit available: NO KEV: NO Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11086 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11077 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11076 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11074 Severity: HIGH (CVSS 8.8) Software: Google Chrome, Linux Linux Kernel Exploit available: NO KEV: NO Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11068 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in WebSockets in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11060 Severity: HIGH (CVSS 8.8) Software: Google Chrome, Microsoft Windows Exploit available: NO KEV: NO Use after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11059 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11058 Severity: HIGH (CVSS 7.5) Software: Google Chrome, Microsoft Windows Exploit available: NO KEV: NO Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform OS-level privilege escalation via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11055 Severity: HIGH (CVSS 8.8) Software: Google Chrome, Microsoft Windows Exploit available: NO KEV: NO Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11054 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11050 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11049 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11046 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


Google Chrome
Google Chrome Os
Linux Linux Kernel

CVE: CVE-2026-11028 Severity: HIGH (CVSS 8.8) Software: Google Chrome, Google Chrome Os, Linux Linux Kernel Exploit available: NO KEV: NO Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11188 Severity: HIGH (CVSS 8.8) Software: Google Android, Google Chrome Exploit available: NO KEV: NO Use after free in USB in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11201 Severity: HIGH (CVSS 8.8) Software: Apple Macos, Google Chrome, Linux Linux Kernel, Microsoft Windows Exploit available: NO KEV: NO Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)


CVE: CVE-2026-11202 Severity: HIGH (CVSS 8.8) Software: Apple Iphone Os, Google Chrome Exploit available: NO KEV: NO Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)


CVE: CVE-2026-11203 Severity: MEDIUM (CVSS 6.5) Software: Apple Macos, Google Chrome Exploit available: NO KEV: NO Inappropriate implementation in GPU in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)


CVE ID: CVE-2026-9719 Severity: MEDIUM (CVSS 4.3) CWE: CWE-352 KEV (actively exploited): NO Description: The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the change_status function. This makes it possible for unauthenticated attackers to change the status of arbitrary invoices — including marking unpaid invoices as paid — without administrator consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.


CVE ID: CVE-2026-9290 Severity: HIGH (CVSS 7.5) CWE: CWE-22 KEV (actively exploited): NO Description: The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.


CVE ID: CVE-2026-8976 Severity: MEDIUM (CVSS 4.3) CWE: CWE-862 KEV (actively exploited): NO Description: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create and execute RSS import jobs, purge (force-delete) all posts associated with any import job, clear import error logs, and enumerate taxonomy terms and post meta_key names. The nonce required to reach these sub-handlers is leaked to any user with the edit_posts capability via the feedzyjs localized script injected into the block editor, meaning no privileged nonce theft or separate exploit step is required for Contributor-level users.


CVE ID: CVE-2026-8900 Severity: MEDIUM (CVSS 6.4) CWE: CWE-79 KEV (actively exploited): NO Description: The Simple SEO Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress KSES does not strip malicious shortcode attribute values on post save, allowing contributor-level users to persist payloads that execute for any visitor, including administrators reviewing the post.


CVE ID: CVE-2026-8893 Severity: MEDIUM (CVSS 6.4) CWE: CWE-79 KEV (actively exploited): NO Description: The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in versions up to, and including, 1.28.0. This is due to insufficient input sanitization and output escaping on the shortcode attribute value, which is concatenated into an HTML attribute in the rendered output of the register_shortcode() function without being passed through esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.