CVE watch

CVE-2026-25291 published: Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.

CVE-2026-105701 published: The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environm...

CVE-2026-105778 published: A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. I...

CVE-2026-105776 published: A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation o...

CVE-2026-25263 published: Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.

CVE-2026-25267 published: Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

CVE-2026-97300 published: Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.

CVE-2026-39760 published: Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

CVE-2026-75962 published: The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 du...

CVE-2026-39789 published: Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.

CVE-2026-41558 published: Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions.

CVE-2026-41563 published: Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.

CVE-2026-39599 published: Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

CVE-2026-39723 published: Unauthenticated Broken Access Control in Morning for WooCommerce <= 2.4.1 versions.

CVE-2026-105708 published: A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launc...

CVE-2026-105775 published: A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out...

CVE-2026-32576 published: Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3....

CVE-2026-32582 published: Contributor Broken Access Control in IATO MCP <= 1.11.0 versions.

CVE-2026-105072 published: Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.

CVE-2026-105706 published: A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available t...