🚨 CVE-2026-28173
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
🎖@cveNotify
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28174
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.
🎖@cveNotify
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress WP Event SOlution Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28175
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Visitors Traffic Real Time Statistics Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28176
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
🎖@cveNotify
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28181
Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
🎖@cveNotify
Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress AcyMailing SMTP Newsletter Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28182
Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
🎖@cveNotify
Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress AcyMailing SMTP Newsletter Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28185
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
🎖@cveNotify
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28187
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Knowledge Base for Documentation, FAQs with AI Assistance Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28188
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.
🎖@cveNotify
Patchstack
undefined in undefined undefined undefined
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-48702
Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.
🎖@cveNotify
Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.
🎖@cveNotify
GitHub
OOM condition due to Unbounded gzip decompression in Alpine APK parsing
## Description
The `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the tota...
The `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the tota...
🚨 CVE-2026-61960
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WP Full Stripe Free Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-61962
Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
🎖@cveNotify
Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
🎖@cveNotify
Patchstack
Arbitrary Code Execution in WordPress WP BASE Booking Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-61965
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress GeekyBot Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-61974
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Mang Board WP Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-61978
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-61979
Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.
🎖@cveNotify
Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress SAML SP Single Sign On Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.