🚨 CVE-2026-79483
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.
🎖@cveNotify
FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat history titles of all users across the platform.
🎖@cveNotify
GitHub
GitHub - ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection: FastGPT Community Edition NoSQL Injection PoC (CVE-2026-79483)
FastGPT Community Edition NoSQL Injection PoC (CVE-2026-79483) - ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection
🚨 CVE-2026-81278
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Post SMTP: from 4.0.0 through beta.1.
🎖@cveNotify
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Post SMTP: from 4.0.0 through beta.1.
🎖@cveNotify
Patchstack
Settings Change in WordPress Post SMTP Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81280
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
🎖@cveNotify
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
🎖@cveNotify
🚨 CVE-2026-81290
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Email Subscribers & Newsletters Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81297
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
🎖@cveNotify
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress Fluent Forms Pro Add On Pack Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81298
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress LeadConnector Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81756
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
🎖@cveNotify
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress Smart Marketing SMS and Newsletters Forms Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81762
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
🎖@cveNotify
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Booking and Rental Manager Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81764
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Email Essentials Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81765
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Tailored Tools Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81768
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Super Store Finder Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81778
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
🎖@cveNotify
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Kalles Addons Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81779
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspapers X: from 1.0.46 through 1.0.48.
🎖@cveNotify
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspapers X: from 1.0.46 through 1.0.48.
🎖@cveNotify
Patchstack
Backdoor in WordPress Newspapers X Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81887
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4.
🎖@cveNotify
Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4.
🎖@cveNotify
GitHub
[3.x] Improve query string parsing and effect handling (#10467) · livewire/livewire@11ebe64
A full-stack framework for Laravel that takes the pain out of building dynamic UIs. - [3.x] Improve query string parsing and effect handling (#10467) · livewire/livewire@11ebe64
🚨 CVE-2026-81888
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
🎖@cveNotify
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
🎖@cveNotify
GitHub
fix(oauth-providers): fail closed on missing OAuth state to prevent l… · honojs/middleware@b37765f
…ogin CSRF (#2040)
* fix(oauth-providers): fail closed on missing OAuth state to prevent login CSRF
* changeset
* fix(oauth-providers): fail closed on missing OAuth state to prevent login CSRF
* changeset