🚨 CVE-2026-78273
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
🎖@cveNotify
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Fluent Boards Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78281
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress CP Media Player Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78283
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Music Player for WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78286
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
🎖@cveNotify
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Geo Controller Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78288
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
🎖@cveNotify
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress Beautiful Taxonomy Filters Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78289
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress CozyStay Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78293
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WP w3all phpBB Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-80433
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
🎖@cveNotify
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress SureFeedback Client Site Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81271
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
🎖@cveNotify
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
🎖@cveNotify
Patchstack
Cross Site Request Forgery (CSRF) in WordPress GeoDirectory Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81273
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
🎖@cveNotify
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
🎖@cveNotify
Patchstack
Cross Site Request Forgery (CSRF) in WordPress FluentBooking Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81277
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
🎖@cveNotify
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress Suggestion Engine for WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81279
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
🎖@cveNotify
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
🎖@cveNotify
🚨 CVE-2026-81560
A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
🎖@cveNotify
A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
🎖@cveNotify
GitHub
GitHub - blackms/aistack: Production-grade agent orchestration for Claude Code - 11 agents, 46 MCP tools, SQLite+FTS5, drift detection…
Production-grade agent orchestration for Claude Code - 11 agents, 46 MCP tools, SQLite+FTS5, drift detection, consensus checkpoints - blackms/aistack
🚨 CVE-2026-81562
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component.
🎖@cveNotify
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.10.3 is able to mitigate this issue. The patch is named a86d9e55694c98a122943eeff859461d0b9aa6d6. It is suggested to upgrade the affected component.
🎖@cveNotify
GitHub
GitHub - AlexGladkov/claude-in-mobile: MCP server for mobile and desktop automation — Android (via ADB), iOS Simulator (via simctl)…
MCP server for mobile and desktop automation — Android (via ADB), iOS Simulator (via simctl), and Desktop (Compose Multiplatform). Like Claude in Chrome but for mobile devices and desktop apps - Al...