🚨 CVE-2026-66640
Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Login With Ajax Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66641
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Video Conferencing with Zoom Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66643
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Wufoo Shortcode Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66644
Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Typing Effect Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66645
Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Table Of Contents Block Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66646
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WP Tab Widget Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66651
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.14 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress MultiVendorX Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66667
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Templately Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66679
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Appointment Hour Booking Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-66793
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.
🎖@cveNotify
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.
🎖@cveNotify
Redhat
CVE-2026-66793 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-68565
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress GeoDirectory Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-68939
Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0.
🎖@cveNotify
Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0.
🎖@cveNotify
GitHub
Merge commit from fork · pyenv/pyenv@95df7db
Simple Python version management. Contribute to pyenv/pyenv development by creating an account on GitHub.
🚨 CVE-2026-69189
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.
🎖@cveNotify
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0.
🎖@cveNotify
GitHub
fix(backend): enforce ownership on user history and private User fiel… · hoppscotch/hoppscotch@9cc980b
…ds (#6409)
* fix(backend): enforce ownership on user history and private User fields
* test: fix unit test cases
* fix(backend): gate private User field resolvers to their owner
* fix(backend)...
* fix(backend): enforce ownership on user history and private User fields
* test: fix unit test cases
* fix(backend): gate private User field resolvers to their owner
* fix(backend)...
🚨 CVE-2026-70657
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17.
🎖@cveNotify
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17.
🎖@cveNotify
GitHub
fix GHSA-x5pq-m9p8-f4vx; no dk with fk · 9001/copyparty@e407553
Portable file server with accelerated resumable uploads, dedup, WebDAV, SFTP, FTP, TFTP, zeroconf, media indexer, thumbnails++ all in one file - fix GHSA-x5pq-m9p8-f4vx; no dk with fk · 9001/copyparty@e407553
🚨 CVE-2026-71539
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
🎖@cveNotify
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
🎖@cveNotify
GitHub
Release n8n@1.123.64 · n8n-io/n8n
1.123.64 (2026-07-08)
🚨 CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
🎖@cveNotify
🚨 CVE-2026-73189
Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions.
🎖@cveNotify
Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions.
🎖@cveNotify
🚨 CVE-2026-73190
Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WPDM – Premium Packages Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.