CVE watch

CVE-2026-104670 published: Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

CVE-2026-104406 published: Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

CVE-2026-104405 published: Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

CVE-2026-104395 published: Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

CVE-2026-104394 published: Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

CVE-2026-104387 published: Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

CVE-2026-104385 published: Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

CVE-2026-103346 published: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

CVE-2026-102915 published: Subscriber Broken Access Control in WPO365 <= 44.1 versions.

CVE-2026-102387 published: Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

CVE-2026-105807 published: A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.

CVE-2026-57546 published: Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

CVE-2026-57545 published: Memory corruption when processing draw objects of incorrect type during graphics command list execution.

CVE-2026-57537 published: Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.

CVE-2026-25302 published: Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

CVE-2026-25291 published: Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.

CVE-2026-25267 published: Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

CVE-2026-105776 published: A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation o...

CVE-2026-105701 published: The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environm...

CVE-2026-75962 published: The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 du...