🚨 CVE-2026-66457
Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Events Manager Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66470
Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.
🎖@cveNotify
Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Frontend Admin by DynamiApps Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66663
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WP Data Access Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66678
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.
🎖@cveNotify
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Advanced Custom Fields: Font Awesome Field Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66683
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress Custom CSS and JavaScript Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66685
Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress Featured Video Plus Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66686
Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
🎖@cveNotify
Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
🎖@cveNotify
Patchstack
Cross Site Request Forgery (CSRF) in WordPress Plugins Garbage Collector (Database Cleanup) Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66694
Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Thrive Architect Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66702
Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Rank Math SEO Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66703
Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress MailOptin Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66706
Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
🎖@cveNotify
Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Subscribe to Comments Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66708
Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Total Upkeep Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66711
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
🎖@cveNotify
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WooCommerce Multilingual & Multicurrency Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-67261
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying operating system with root privileges. Exploitation may lead to a complete system takeover by an attacker. This vulnerability is considered critical as it allows an unauthenticated remote attacker to achieve arbitrary code execution as root, potentially compromising the entire VSI deployment and underlying infrastructure. Dell recommends customers to upgrade at the earliest opportunity.
🎖@cveNotify
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying operating system with root privileges. Exploitation may lead to a complete system takeover by an attacker. This vulnerability is considered critical as it allows an unauthenticated remote attacker to achieve arbitrary code execution as root, potentially compromising the entire VSI deployment and underlying infrastructure. Dell recommends customers to upgrade at the earliest opportunity.
🎖@cveNotify
🚨 CVE-2026-70637
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
🎖@cveNotify
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
🎖@cveNotify
GitHub
[SECURITY] LightFTP: concurrent fd close race — worker_thread_cleanup vs transfer worker thread · Issue #75 · hfiref0x/LightFTP
Summary The per-connection control thread (ftp_client_thread) and the detached transfer worker thread (stor_thread / retr_thread / list_thread) share ftp_context fields — specifically context->d...
🚨 CVE-2026-18258
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
🎖@cveNotify
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
🎖@cveNotify
GitLab
Scripta / escriptorium · GitLab
A project providing digital recognition of handwritten documents using machine learning techniques. https://escriptorium.eu/
🚨 CVE-2026-18275
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect
🎖@cveNotify
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect
🎖@cveNotify
GitLab
Scripta / escriptorium · GitLab
A project providing digital recognition of handwritten documents using machine learning techniques. https://escriptorium.eu/