🚨 CVE-2026-82970
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files.
This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.
🎖@cveNotify
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files.
This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.
🎖@cveNotify
Patchstack
Arbitrary File Upload in WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-82802
A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
GitHub
thoropass-vuln-research-program/2026/Unauthenticated OpenSearch Granule SSRF at main · natanmorette-thoropass/thoropass-vuln-research…
Thoropass Vulnerability Research Program. Contribute to natanmorette-thoropass/thoropass-vuln-research-program development by creating an account on GitHub.
🚨 CVE-2026-82809
A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."
🎖@cveNotify
A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "At this time, vidIQ does not accept security vulnerability submissions, and we do not have a bug bounty program in place."
🎖@cveNotify
GitHub
chrome_extensions/vidIQ Inc. vidIQ Vision for YouTube 3.199.0 exposes YouTube video frame captures through an unauthenticated postMessage…
Contribute to xryj920/chrome_extensions development by creating an account on GitHub.
🚨 CVE-2026-82815
A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the argument X-Forwarded-For/X-Real-IP/True-Client-IP causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the argument X-Forwarded-For/X-Real-IP/True-Client-IP causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
GitHub
GitHub - BiBi8BoBo/megaease_easeprobe-unvalidated-X-Forwarded-For-header: easeprobe
easeprobe. Contribute to BiBi8BoBo/megaease_easeprobe-unvalidated-X-Forwarded-For-header development by creating an account on GitHub.
🚨 CVE-2026-82817
A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
🎖@cveNotify
🚨 CVE-2026-81278
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Post SMTP: from 4.0.0 through beta.1.
🎖@cveNotify
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Post SMTP: from 4.0.0 through beta.1.
🎖@cveNotify
Patchstack
Settings Change in WordPress Post SMTP Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81280
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
🎖@cveNotify
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
🎖@cveNotify
🚨 CVE-2026-81290
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Email Subscribers & Newsletters Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81296
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Fluent Forms Pro Add On Pack Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81297
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
🎖@cveNotify
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress Fluent Forms Pro Add On Pack Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81298
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress LeadConnector Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81756
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
🎖@cveNotify
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress Smart Marketing SMS and Newsletters Forms Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81762
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
🎖@cveNotify
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Booking and Rental Manager Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81764
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Email Essentials Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81765
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Tailored Tools Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81768
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Super Store Finder Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.