🚨 CVE-2026-65544
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Super Socializer Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-65554
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.
🎖@cveNotify
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress AnsPress – Question and answer Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-65559
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.
🎖@cveNotify
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress Order Delivery Date for WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-65571
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
🎖@cveNotify
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66447
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
🎖@cveNotify
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress WordPress File Upload Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66662
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
🎖@cveNotify
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress Frontend Admin by DynamiApps Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66681
Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
🎖@cveNotify
Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
🎖@cveNotify
Patchstack
Cross Site Request Forgery (CSRF) in WordPress Theme My Login Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66696
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
🎖@cveNotify
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress Gutenberg Blocks by Kadence Blocks Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66705
Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Facebook for WordPress Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66712
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Simple Membership Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-70637
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
🎖@cveNotify
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
🎖@cveNotify
GitHub
[SECURITY] LightFTP: concurrent fd close race — worker_thread_cleanup vs transfer worker thread · Issue #75 · hfiref0x/LightFTP
Summary The per-connection control thread (ftp_client_thread) and the detached transfer worker thread (stor_thread / retr_thread / list_thread) share ftp_context fields — specifically context->d...
🚨 CVE-2026-18258
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
🎖@cveNotify
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
🎖@cveNotify
GitLab
Scripta / escriptorium · GitLab
A project providing digital recognition of handwritten documents using machine learning techniques. https://escriptorium.eu/
🚨 CVE-2026-18275
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect
🎖@cveNotify
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect
🎖@cveNotify
GitLab
Scripta / escriptorium · GitLab
A project providing digital recognition of handwritten documents using machine learning techniques. https://escriptorium.eu/
🚨 CVE-2026-18276
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check
🎖@cveNotify
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check
🎖@cveNotify
GitLab
Scripta / escriptorium · GitLab
A project providing digital recognition of handwritten documents using machine learning techniques. https://escriptorium.eu/