🚨 CVE-2026-81773
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Ninja Forms File Uploads Extension Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-81776
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
🎖@cveNotify
🚨 CVE-2026-84238
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress YITH Request a Quote for WooCommerce Premium Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-84736
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification.
As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens.
The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.
🎖@cveNotify
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification.
As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens.
The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.
🎖@cveNotify
GitHub
fix(security): set TLS_CERTIFICATE_VALIDATION true by default · eclipse-aerios/federator@9c63b60
The aeriOS Federator serves as a management service responsible for controlling the establishment and maintenance of federation mechanisms among the multiple aeriOS domains that form the Cloud-Edge-IoT continuum - fix(security): set TLS_CERTIFICATE_VALIDATION…
🚨 CVE-2026-84758
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
🎖@cveNotify
🚨 CVE-2026-84761
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
🎖@cveNotify
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
🎖@cveNotify
🚨 CVE-2026-84765
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Breadcrumb NavXT Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-84766
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
🎖@cveNotify
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
🎖@cveNotify
🚨 CVE-2026-84768
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
🎖@cveNotify
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
🎖@cveNotify
🚨 CVE-2026-84769
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
🎖@cveNotify
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
🎖@cveNotify
Patchstack
Insecure Direct Object References (IDOR) in WordPress Business Directory Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-84773
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress EWWW Image Optimizer Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-84774
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.
🎖@cveNotify