🚨 CVE-2026-51300
A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to release an expression object, the program still retains the dangling pointer and subsequently accesses member fields of the already freed memory. By constructing malicious SQL queries, a remote attacker can trigger invalid memory access, leading to application crash and sensitive memory information leakage.
🎖@cveNotify
A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to release an expression object, the program still retains the dangling pointer and subsequently accesses member fields of the already freed memory. By constructing malicious SQL queries, a remote attacker can trigger invalid memory access, leading to application crash and sensitive memory information leakage.
🎖@cveNotify
GitHub
cveadvisory-/CVE-2026-51300 at main · programmervuln/cveadvisory-
details to cve applications. Contribute to programmervuln/cveadvisory- development by creating an account on GitHub.
🚨 CVE-2026-51302
SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, and the subsequent exprComputeOperands function continues to access the already freed register memory. By supplying a malicious SQL statement, a remote attacker can exploit this flaw to cause denial of service, leak sensitive information, or potentially execute arbitrary code on the affected system.
🎖@cveNotify
SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, and the subsequent exprComputeOperands function continues to access the already freed register memory. By supplying a malicious SQL statement, a remote attacker can exploit this flaw to cause denial of service, leak sensitive information, or potentially execute arbitrary code on the affected system.
🎖@cveNotify
GitHub
cveadvisory-/CVE-2026-51302 at main · programmervuln/cveadvisory-
details to cve applications. Contribute to programmervuln/cveadvisory- development by creating an account on GitHub.
🚨 CVE-2026-43730
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user.
🎖@cveNotify
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user.
🎖@cveNotify
Apple Support
About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support
This document describes the security content of iOS 26.6 and iPadOS 26.6.
🚨 CVE-2026-43747
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Parsing a maliciously crafted file may lead to an unexpected app termination.
🎖@cveNotify
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Parsing a maliciously crafted file may lead to an unexpected app termination.
🎖@cveNotify
Apple Support
About the security content of macOS Tahoe 26.6 - Apple Support
This document describes the security content of macOS Tahoe 26.6.
🚨 CVE-2026-43771
A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.
🎖@cveNotify
A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.
🎖@cveNotify
Apple Support
About the security content of macOS Tahoe 26.6 - Apple Support
This document describes the security content of macOS Tahoe 26.6.
🚨 CVE-2026-64697
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.
🎖@cveNotify
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.
🎖@cveNotify
Apple Support
About the security content of macOS Tahoe 26.6 - Apple Support
This document describes the security content of macOS Tahoe 26.6.
🚨 CVE-2026-55685
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
🎖@cveNotify
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0.
🎖@cveNotify
GitHub
react-router/CHANGELOG.md at main · remix-run/react-router
Declarative routing for React. Contribute to remix-run/react-router development by creating an account on GitHub.
🚨 CVE-2025-63913
An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.
🎖@cveNotify
An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.
🎖@cveNotify
GitHub
GitHub - luojia65/opensbi-pmu2-crash: RISC-V OpenSBI PMU #2 vulnerbility
RISC-V OpenSBI PMU #2 vulnerbility. Contribute to luojia65/opensbi-pmu2-crash development by creating an account on GitHub.
🚨 CVE-2026-51565
Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request
🎖@cveNotify
Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request
🎖@cveNotify
GitHub
GitHub - 1337Skid/CVE-2026-51565: Security Advisory for CVE-2026-51565
Security Advisory for CVE-2026-51565. Contribute to 1337Skid/CVE-2026-51565 development by creating an account on GitHub.
🚨 CVE-2026-65438
Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Message Filter for Contact Form 7 Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-65440
Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress GetGenie Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-65445
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Ad Invalid Click Protector (AICP) Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-65447
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Contest Gallery Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-12124
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
🎖@cveNotify
The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() function and the serveTemplatePdf() REST route (which is registered with `permission_callback => '__return_true'`) in versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to download stored template PDFs — which may contain customer PII, invoice, order, and certificate data — by requesting the publicly registered admin-ajax action `pdfdraft_embed_pdf` or the REST endpoint `/wp-json/pdfdraft/v1/embed-pdf/templates/{slug}/pdf` with a known or guessable design slug, bypassing the plugin's own .
🎖@cveNotify
🚨 CVE-2026-14490
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explicitly accepts possession of the on-disk signing key as a standalone alternative to WordPress capability and nonce checks; an unauthenticated attacker who retrieves the exposed key can forge a valid signed state envelope to invoke `CleanDir::execute()` with a caller-supplied absolute path that is subject to no allow-list or path-canonicalization check. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server.
🎖@cveNotify
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file protection — and the `demi_restore_step` AJAX handler, registered for unauthenticated callers, explicitly accepts possession of the on-disk signing key as a standalone alternative to WordPress capability and nonce checks; an unauthenticated attacker who retrieves the exposed key can forge a valid signed state envelope to invoke `CleanDir::execute()` with a caller-supplied absolute path that is subject to no allow-list or path-canonicalization check. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server.
🎖@cveNotify
🚨 CVE-2026-14545
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
🎖@cveNotify
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.
🎖@cveNotify
WPScan
TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
See details on TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset CVE 2026-14545. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14819
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.
🎖@cveNotify
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations.
🎖@cveNotify
WPScan
Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move
See details on Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move CVE 2026-14819. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14821
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.
🎖@cveNotify
The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.
🎖@cveNotify
WPScan
Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion
See details on Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion CVE 2026-14821. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14870
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
🎖@cveNotify
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
🎖@cveNotify
WPScan
Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id
See details on Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id CVE 2026-14870. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14924
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.
🎖@cveNotify
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.
🎖@cveNotify
WPScan
Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification
See details on Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification CVE 2026-14924. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14926
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.
🎖@cveNotify
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription (changing its payment method, or cancelling and re-binding it) when they know the target subscription identifier.
🎖@cveNotify
WPScan
FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
See details on FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR CVE 2026-14926. View the latest Plugin Vulnerabilities on WPScan.