CVE-2026-38764 - An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate priv

CVE-2026-34496 - Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affect

CVE-2026-21655 - Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Contro

CVE-2026-21653 - Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server

CVE-2026-16796 - Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent

CVE-2026-16002 - The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash th

CVE-2026-15981 - The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in a

CVE-2026-15968 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-15967 - Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEi

CVE-2026-15966 - Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Tran

CVE-2026-15630 - A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or mod

CVE-2026-10697 - Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transf

CVE-2026-65706 - FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect vi

CVE-2026-65705 - FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill v

CVE-2026-65704 - FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause he

CVE-2026-65703 - FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video dec

CVE-2026-64785 - SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other

CVE-2026-63359 - The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an

CVE-2026-60122 - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the

CVE-2026-48013 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/exte

CVE-2026-48012 - Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Sh

CVE-2026-47722 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to v

CVE-2026-47670 - DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated

CVE-2026-47669 - DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` funct

CVE-2026-25800 - Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting

CVE-2026-15212 - The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up t

CVE-2026-12353 - An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for R

CVE-2026-65010 - Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extrac

CVE-2026-63765 - Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads control

CVE-2026-16756 - Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the de

CVE-2026-15687 - A security issue was discovered in the Kubernetes Java client library where a compromised pod may be

CVE-2026-6516 - Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code

CVE-2026-65920 - Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _g

CVE-2026-65919 - Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/syst

CVE-2026-65918 - PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vul

CVE-2026-65763 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper valid

CVE-2026-65762 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper

CVE-2026-65702 - Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persi

CVE-2026-65701 - SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability

CVE-2026-65700 - h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that

CVE-2026-65699 - AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability th

CVE-2026-47769 - APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP

CVE-2026-47755 - ITFlow provides an IT documentation, ticketing and accounting system for small managed service provi

CVE-2026-47752 - Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2

CVE-2026-47743 - Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewir

CVE-2026-47668 - DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner

CVE-2026-44210 - Kata Containers is an open source project focusing on a standard implementation of lightweight Virtu

CVE-2026-65761 - Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.

CVE-2026-65760 - Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy

CVE-2026-65759 - Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.

CVE-2026-65698 - Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that a

CVE-2026-65697 - Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics coll

CVE-2026-65696 - Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability

CVE-2026-65695 - Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools

CVE-2026-44909 - Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A re

CVE-2026-16768 - A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exc

CVE-2026-65917 - CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDO

CVE-2026-65916 - CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in

CVE-2026-48539 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights s

CVE-2026-48538 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import

CVE-2026-48537 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive A

CVE-2026-48536 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settin

CVE-2026-48535 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home prox

CVE-2026-48534 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server co

CVE-2026-48533 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-48532 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History R

CVE-2026-48531 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Poli

CVE-2026-48530 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification

CVE-2026-16584 - Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 migh

CVE-2026-15617 - Logto performs principal lookup without normalizing email and identifier strings, enabling principal

CVE-2026-15616 - Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass se

CVE-2026-15615 - Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audien

CVE-2026-15614 - Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within

CVE-2026-15612 - Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling repl

CVE-2026-15611 - Logto allows unverified email-based SSO account linking, enabling an attacker to register an identit

CVE-2026-11804 - Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framewo

CVE-2026-43823 - When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-f

CVE-2026-43820 - NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSS

CVE-2026-8287 - Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems

CVE-2026-65914 - DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into

CVE-2026-65913 - DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows

CVE-2026-65912 - DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a

CVE-2026-65911 - In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanit

CVE-2026-65904 - DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element ori

CVE-2026-65903 - DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluatio

CVE-2026-65902 - DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEF

CVE-2026-65901 - DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts a

CVE-2026-65900 - DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a

CVE-2026-65899 - DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is

CVE-2026-65898 - DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an u

CVE-2026-65690 - Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner

CVE-2026-65689 - Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner

CVE-2026-65688 - Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner

CVE-2026-65687 - Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner

CVE-2026-16735 - A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This a

CVE-2026-16733 - A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is

CVE-2026-14257 - brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()

CVE-2026-65908 - In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executabl

CVE-2026-65907 - In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

CVE-2026-65906 - In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was po

CVE-2026-15037 - Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction se

CVE-2026-65897 - Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::c

CVE-2026-65896 - Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate

CVE-2026-65895 - Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin con

CVE-2026-65608 - Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory

CVE-2026-65607 - SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit bran

CVE-2026-65606 - SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler

CVE-2026-65605 - SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (databas

CVE-2026-65550 - Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

CVE-2026-65540 - Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 version

CVE-2026-65539 - Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

CVE-2026-65538 - Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

CVE-2026-65537 - Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <=

CVE-2026-65536 - Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی،

CVE-2026-65535 - Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.

CVE-2026-65534 - Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

CVE-2026-65533 - Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.

CVE-2026-65532 - Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

CVE-2026-65531 - Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.

CVE-2026-65530 - Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

CVE-2026-65529 - Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.

CVE-2026-65528 - Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.

CVE-2026-65527 - Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

CVE-2026-65526 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-65525 - Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

CVE-2026-65524 - Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

CVE-2026-65522 - Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPre

CVE-2026-65521 - Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.

CVE-2026-65519 - Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

CVE-2026-65518 - Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.

CVE-2026-65516 - Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVE-2026-65514 - Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.

CVE-2026-65512 - Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activi

CVE-2026-65511 - Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education Wor

CVE-2026-65510 - Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVE-2026-65506 - Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.

CVE-2026-65505 - Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

CVE-2026-65503 - Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

CVE-2026-65501 - Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 vers

CVE-2026-65500 - Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPres

CVE-2026-65499 - Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

CVE-2026-65498 - Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.

CVE-2026-65497 - Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

CVE-2026-65496 - Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.

CVE-2026-65495 - Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

CVE-2026-65494 - Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

CVE-2026-65493 - Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

CVE-2026-65492 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-65491 - Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.

CVE-2026-65490 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Mic

CVE-2026-65489 - Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-elemen

CVE-2026-65488 - Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor las

CVE-2026-65487 - Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

CVE-2026-65486 - Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

CVE-2026-65485 - Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

CVE-2026-65484 - Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

CVE-2026-65483 - Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

CVE-2026-65482 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-65481 - Contributor Local File Inclusion in Vino <= 1.9 versions.

CVE-2026-65480 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-65479 - Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

CVE-2026-65478 - Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

CVE-2026-65477 - Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

CVE-2026-65476 - Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

CVE-2026-65475 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-65474 - Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.

CVE-2026-65473 - Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

CVE-2026-65472 - Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

CVE-2026-65471 - Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions.

CVE-2026-65470 - Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.

CVE-2026-65469 - Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

CVE-2026-65468 - Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

CVE-2026-65467 - Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.

CVE-2026-65466 - Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

CVE-2026-65465 - Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.

CVE-2026-65464 - Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.

CVE-2026-65463 - Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

CVE-2026-65462 - Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

CVE-2026-65461 - Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.

CVE-2026-65460 - Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.

CVE-2026-65458 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby P

CVE-2026-65457 - Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

CVE-2026-65456 - Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 ve

CVE-2026-65455 - Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.

CVE-2026-65454 - Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

CVE-2026-65453 - Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

CVE-2026-65452 - Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

CVE-2026-65451 - Contributor SQL Injection in MapSVG <= 8.14.0 versions.

CVE-2026-65450 - Contributor SQL Injection in MapSVG <= 8.14.0 versions.

CVE-2026-65449 - Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.

CVE-2026-64815 - In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form

CVE-2026-64814 - In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Developme

CVE-2026-64813 - In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote

CVE-2026-64812 - In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Devel

CVE-2026-64811 - In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting proje

CVE-2026-64810 - In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowin

CVE-2026-64809 - In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project tr

CVE-2026-64808 - In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project tr

CVE-2026-64807 - In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied lin

CVE-2026-64806 - In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr

CVE-2026-64805 - In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr

CVE-2026-64804 - In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr

CVE-2026-64803 - In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trus

CVE-2026-64802 - In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trus

CVE-2026-64800 - In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default

CVE-2026-61981 - Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

CVE-2026-61973 - Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

CVE-2026-61972 - Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

CVE-2026-61954 - Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

CVE-2026-61951 - Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.

CVE-2026-61950 - Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.

CVE-2026-61949 - Unauthenticated SQL Injection in Bookly <= 27.7 versions.

CVE-2026-61948 - Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.

CVE-2026-61947 - Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versi

CVE-2026-61946 - Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.

CVE-2026-61945 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVen

CVE-2026-61944 - Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

CVE-2026-61943 - Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

CVE-2026-59555 - Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

CVE-2026-59554 - Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.

CVE-2026-59547 - Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions

CVE-2026-59545 - Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

CVE-2026-59544 - Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.

CVE-2026-59543 - Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

CVE-2026-59542 - Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

CVE-2026-59541 - Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.

CVE-2026-59540 - Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.

CVE-2026-59526 - Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

CVE-2026-59525 - Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.

CVE-2026-59524 - Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

CVE-2026-59522 - Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

CVE-2026-59517 - Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

CVE-2026-59514 - Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.

CVE-2026-59513 - Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

CVE-2026-59512 - Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.

CVE-2026-57809 - Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.

CVE-2026-57808 - Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.

CVE-2026-57785 - Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

CVE-2026-57784 - Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 v

CVE-2026-57769 - Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

CVE-2026-57767 - Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

CVE-2026-57735 - Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

CVE-2026-57717 - Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

CVE-2026-57716 - Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.

CVE-2026-57704 - Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

CVE-2026-57703 - Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

CVE-2026-57701 - Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.

CVE-2026-57699 - Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.

CVE-2026-57696 - Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.

CVE-2026-57626 - Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This