🚨 CVE-2026-12513
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
🎖@cveNotify
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover.
🎖@cveNotify
WPScan
Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal
See details on Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal CVE 2026-12513. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-12514
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
🎖@cveNotify
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visitor can upload files to a publicly accessible directory and read the server's absolute path from the response. Uploads are limited to WordPress's allowed MIME types, so executable PHP cannot be uploaded.
🎖@cveNotify
WPScan
Shared Files < 1.7.70 - Unauthenticated Limited File Upload
See details on Shared Files < 1.7.70 - Unauthenticated Limited File Upload CVE 2026-12514. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14558
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
🎖@cveNotify
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
🎖@cveNotify
WPScan
WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder
See details on WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder CVE 2026-14558. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-14567
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
🎖@cveNotify
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
🎖@cveNotify
WPScan
WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
See details on WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory CVE 2026-14567. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-19084
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.
🎖@cveNotify
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.
🎖@cveNotify
WPScan
Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read
See details on Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read CVE 2026-19084. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-19423
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.
🎖@cveNotify
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant themselves arbitrary capabilities and reach administrator-equivalent access.
🎖@cveNotify
WPScan
Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms
See details on Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms CVE 2026-19423. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-40541
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
🎖@cveNotify
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
🎖@cveNotify
Synology
Synology_SA_26_10 | Synology Inc.
Synology Product Security Advisory
🚨 CVE-2026-73827
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
🎖@cveNotify
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
🎖@cveNotify
jvn.jp
JVN#04485476: Multiple vulnerabilities in SOY series
Japan Vulnerability Notes
🚨 CVE-2026-77701
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.
🎖@cveNotify
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.
🎖@cveNotify
WPScan
WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders
See details on WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders CVE 2026-77701. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-77838
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
🎖@cveNotify
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
🎖@cveNotify
jvn.jp
JVN#04485476: Multiple vulnerabilities in SOY series
Japan Vulnerability Notes
🚨 CVE-2026-78032
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.
🎖@cveNotify
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.
🎖@cveNotify
jvn.jp
JVN#04485476: Multiple vulnerabilities in SOY series
Japan Vulnerability Notes
🚨 CVE-2026-78238
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
🎖@cveNotify
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product.
🎖@cveNotify
jvn.jp
JVN#04485476: Multiple vulnerabilities in SOY series
Japan Vulnerability Notes
🚨 CVE-2026-79706
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.
🎖@cveNotify
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.
🎖@cveNotify
WPScan
Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal
See details on Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal CVE 2026-79706. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-79995
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.
🎖@cveNotify
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.
🎖@cveNotify
WPScan
User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR
See details on User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR CVE 2026-79995. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-79996
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.
🎖@cveNotify
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.
🎖@cveNotify
WPScan
User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings
See details on User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings CVE 2026-79996. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-80697
In the Linux kernel, the following vulnerability has been resolved:
erofs: ensure valid f_path for page cache sharing
Previously, backing files for page cache sharing were set up with
f_path left as NULL (only f_inode was valid). It worked, but a recent
mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on
7.2-rc4):
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
RIP: 0010:__do_sys_mincore+0xc0/0x2c0
...
Specify valid paths using valid disconnected dentries together with
erofs_ishare_mnt instead of leaving f_path empty, so they are more
like real backing files in a pseudo filesystem and standard
backing_file_open() can be used directly.
🎖@cveNotify
In the Linux kernel, the following vulnerability has been resolved:
erofs: ensure valid f_path for page cache sharing
Previously, backing files for page cache sharing were set up with
f_path left as NULL (only f_inode was valid). It worked, but a recent
mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on
7.2-rc4):
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP PTI
CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)
Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
RIP: 0010:__do_sys_mincore+0xc0/0x2c0
...
Specify valid paths using valid disconnected dentries together with
erofs_ishare_mnt instead of leaving f_path empty, so they are more
like real backing files in a pseudo filesystem and standard
backing_file_open() can be used directly.
🎖@cveNotify
🚨 CVE-2026-18918
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.
🎖@cveNotify
In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided `AbstractAdapterCredentialsFilter`, are vulnerable. An attacked can create a provisional trusted client (valid use-case) but then it can be used as a trusted client immediately without requiring the administrator approval to clear the provisional status. The 3-legged path requiring user interaction is not vulnerable and rejects provisional clients.
🎖@cveNotify
GitHub
Release v6.0.1.Final security release · eclipse-lyo/lyo
Security
CVE-2026-18918 A vulnerability was discovered in Eclipse Lyo 6.0.0 and earlier versions, where the AbstractAdapterCredentialsFilter could be misused to bypass authentication when used in ...
CVE-2026-18918 A vulnerability was discovered in Eclipse Lyo 6.0.0 and earlier versions, where the AbstractAdapterCredentialsFilter could be misused to bypass authentication when used in ...
🚨 CVE-2026-40015
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation. Update to non-vulnerable version. No publicly available exploits are known.
🎖@cveNotify
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an out-of-bounds read and crash the process. The crash interrupts hibernated IMAP sessions handled by the affected process, which can cause degradation of service for IMAP. Disable IMAP hibernation. Update to non-vulnerable version. No publicly available exploits are known.
🎖@cveNotify
🚨 CVE-2026-40017
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that fix. Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known.
🎖@cveNotify
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD command consume CPU disproportionate to the size of the message. This is a separate issue from CVE-2026-40014 and is not addressed by that fix. Whenever a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known.
🎖@cveNotify
🚨 CVE-2026-40019
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
🎖@cveNotify
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.
🎖@cveNotify