CVE-2026-28xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
856 records · Page 7 of 9
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.
Updated- CVE-2026-28287: FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints 8.6 High
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
Updated ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other
Updated- CVE-2026-28284: FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module 8.6 High
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. This issue has been patched in versions 16.0.10 and 17.0.5.
Updated Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a security flaw in the discourse-policy plugin which allowed a user with policy creation permission to gain membership access to any private/restricted groups. Once membership to a private/restricted group has been obtained, the user will be able to read private topics that only the gr
UpdatedInstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF tokens, which allows attackers grant moderator privileges to users, execute scheduled tasks, move posts to trash, and accept friend requests on behalf of the user. This vulnerability is fixed in 2.18.1.
Updated- CVE-2026-28280: `osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List 6.1 Medium
osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exists in the `osctrl-admin` on-demand query list. A user with query-level permissions can inject arbitrary JavaScript via the query parameter when running an on-demand query. The payload is stored and executes in the browser of any user (including administrators) who visits the quer
Updated - CVE-2026-28279: `osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration 7.4 High
osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing environments. These commands are embedded into enrollment one-liner scripts generated using Go's `text/template` package
Updated - CVE-2026-28277: LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading 6.8 Medium
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In version 1.0.9 and prior, LangGraph checkpointers can load msgpack-encoded checkpoints that reconstruct Python objects during deserialization. If an attacker can modify checkpoint data in the backing store (for example, after a database compromise or other privi
Updated Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading t
UpdatedInitiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been up
UpdatedInitiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without pr
Updated- CVE-2026-28272: Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability 8.1 High
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.
Updated Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
UpdatedKiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.
UpdatedKiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.
UpdatedVikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker
UpdatedMultiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwritten in the system directory or backup directory by a non-administrative user.
UpdatedPowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files.
UpdatedDell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
UpdatedDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
UpdatedDell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
UpdatedDell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to secret exposure. The attacker may be able to use the exposed secret to access the vulnerable system
UpdatedA Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
UpdatedA Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
UpdatedA Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.
UpdatedA Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition
UpdatedA Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.
UpdatedUnrestricted resource allocation in AMD uProf may be exploitable to consume excessive system resources, potentially leading to a loss of availability.
Updatedpillow_heif is a Python library for working with HEIF images and plugin for Pillow. Prior to version 1.3.0, an integer overflow in the encode path buffer validation of `_pillow_heif.c` allows an attacker to bypass bounds checks by providing large image dimensions, resulting in a heap out-of-bounds read. This can lead to information disclosure (server heap memory leaking into encoded images) or den
UpdatedSteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId (a sequential integer starting from 1) without verifying that the requesting charger matches the charger that originally started the transaction. Any authenticated charger can terminate any othe
UpdatedArgo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is f
UpdatedOpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. Prior to versions 19.1.31, 20.1.18, and 20.2.5, an authenticated user with the Author role can inject Velocity directives into a reminder email template. When the reminder is processed (either triggered manually or via the daily cron job), the injected directives are evaluated server-side
UpdatedDiscourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Updated- CVE-2026-28226: Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing 6.5 Medium
Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown value
Updated Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1, the `get_model` method in `ModelFilesController` (line 158-160) loads models using `Model.find_param(params[:model_id])` without `policy_scope()`, bypassing Pundit authorization. All other controllers correctly use `policy_scope(Model).find_
UpdatedFirebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference and server crash. An unauthenticated attacker who knows only the server's IP and port can exploit this
UpdatedWagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" a
UpdatedWagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary Java
UpdatedWazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists in print_hex_string() in wazuh-remoted. The bug is triggered when formatting attacker-controlled bytes using sprintf(dst_buf + 2*i, "%.2x", src_buf[i]) on platforms where char is treated as signed and the compiled code sign-
UpdatedWazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the master node deserialize an attacker-controlled callable and execute it under an attacker-controlled RBAC c
UpdatedDiscourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper authorization check in the topic management logic allows authenticated users to modify privileged attributes of their topics. By manipulating specific parameters in a PUT or POST request, a regular user can elevate a topic’s status to a site-wide notice or banner, bypassing intended ad
UpdatedDiscourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, including built-in system queries. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. As a workaround, either explicitly set group permissions on
Updated- CVE-2026-28217: IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections 6.5 Medium
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and returns the full collection data — including title, type, and the serialized `data` field containing HTTP requests with headers and potentially secrets — to any authenticated user, without verifying that the requesting user owns the collection
Updated hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation uses `@UseGuards(GqlAuthGuard)` but is missing the `@GqlUser()` decorator entirely. The user's identity is never extracted, so the service receives only th
Updatedhoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP settings by sending a single HTTP POST request with no authentication. The endpoint POST /v1/onboarding/config has no authentication guard and performs
UpdatedFirebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when parsing a Wide type clumplet, causing an infinite loop. An authenticated user with INSERT privileges on any table can exploit this via a crafted Batch Parameter Block to cause a denial of service again
UpdatedEverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.
UpdatedFirebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared structure containing a null pointer to the SDL_info() function, resulting in a null pointer dereference and server crash. An unauthenticated attacker can trigger this by sending a crafted packet to the ser
UpdatedThe NVDA Dev & Test Toolbox is an NVDA add-on for gathering tools to help NVDA development and testing. A vulnerability exists in versions 2.0 through 8.0 in the Log Reader feature of this add-on. A maliciously crafted log file can lead to arbitrary code execution when a user reads it with log reader commands. The log reading command process speech log entries in an unsafe manner. Python expressio
UpdatedFreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue has been patched in versions 16.0.49 and 17.0.7.
UpdatedFreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
UpdatedJunrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron j
UpdatedZen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.2, a command injection vulnerability (CWE-78) in the Zen C compiler allows local attackers to execute arbitrary shell commands by providing a specially crafted output filename via the `-o` command-line argument. The vulnerability existed in the `main` application logic (specifically in `src/main
UpdatedOpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API.
UpdatedCharging station authentication identifiers are publicly accessible via web-based mapping platforms.
UpdatedAn improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible.
Updated- CVE-2026-28199: Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell 4.8 Medium
An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.
Updated - CVE-2026-28198: Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell 9.4 Critical
An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compr
Updated An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, i
UpdatedIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
UpdatedIn JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations
UpdatedIn JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
UpdatedIn JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
Updated- CVE-2026-28192: WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability 9.6 Critical
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
Updated Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0.
Updated- CVE-2026-28190: WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability 7.1 High
Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.
Updated Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
Updated- CVE-2026-28188: WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability 7.3 High
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
Updated- CVE-2026-28186: WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability 8.1 High
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
Updated - CVE-2026-28185: WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability 9.8 Critical
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
Updated This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordIncorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
UpdatedSubscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
UpdatedSubscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
UpdatedUnauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.
Updated- CVE-2026-28179: WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability 5.9 Medium
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
Updated - CVE-2026-28178: WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
Updated - CVE-2026-28177: WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.
Updated - CVE-2026-28176: WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability 8.8 High
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
Updated- CVE-2026-28174: WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability 6.5 Medium
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.
Updated Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
Updated- CVE-2026-28172: WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability 7.1 High
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
Updated Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.
UpdatedUnauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
UpdatedSubscriber SQL Injection in CubeWP <= 1.1.30 versions.
Updated- CVE-2026-28167: WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability 7.5 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.
Updated - CVE-2026-28166: WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.
Updated Unauthenticated Privilege Escalation in Digits <= 9.2 versions.
Updated- CVE-2026-28164: WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability 9.6 Critical
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.
Updated - CVE-2026-28163: WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability 5.3 Medium
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.
Updated Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
Updated- CVE-2026-28161: WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability 8.8 High
Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.
Updated - CVE-2026-28160: WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.
Updated - CVE-2026-28159: WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability 6.5 Medium
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
Updated - CVE-2026-28158: WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.
Updated Subscriber Path Traversal in Do Lasso <= 358 versions.
Updated