🚨 CVE-2026-103068
Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.
🎖@cveNotify
Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.
🎖@cveNotify
Patchstack
Privilege Escalation in WordPress ByteCoreStack – MCP Connector for AI Tools Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-103347
Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.
🎖@cveNotify
Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.
🎖@cveNotify
Patchstack
Bypass Vulnerability in WordPress hCaptcha for WP Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-103687
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.
🎖@cveNotify
A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. The name of the patch is 139c46c3d7c9bc81542b7b5a58d5cde5d0e0195a. Upgrading the affected component is recommended.
🎖@cveNotify
GitHub
GitHub - rhukster/dom-sanitizer: A simple but effective DOM/SVG/MathML Sanitizer for PHP 7.3+
A simple but effective DOM/SVG/MathML Sanitizer for PHP 7.3+ - rhukster/dom-sanitizer
🚨 CVE-2026-56589
HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data.
🎖@cveNotify
HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL BigFix Service Management - Customer Support
HCL BigFix Service Management is affected by multiple security vulnerabilities.
🚨 CVE-2026-56599
HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.
🎖@cveNotify
HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL BigFix Service Management - Customer Support
HCL BigFix Service Management is affected by multiple security vulnerabilities.
🚨 CVE-2026-62071
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.
🎖@cveNotify
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress WordPress File Upload Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-62073
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress WP Full Stripe Free Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-67104
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.
🎖@cveNotify
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL BigFix Service Management - Customer Support
HCL BigFix Service Management is affected by multiple security vulnerabilities.
🚨 CVE-2026-67105
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.
🎖@cveNotify
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL BigFix Service Management - Customer Support
HCL BigFix Service Management is affected by multiple security vulnerabilities.
🚨 CVE-2026-67106
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.
🎖@cveNotify
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL BigFix Service Management - Customer Support
HCL BigFix Service Management is affected by multiple security vulnerabilities.
🚨 CVE-2026-79898
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.
🎖@cveNotify
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.
🎖@cveNotify
🚨 CVE-2026-79899
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.
🎖@cveNotify
Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.
🎖@cveNotify
🚨 CVE-2026-79900
boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.
🎖@cveNotify
boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.
🎖@cveNotify
🚨 CVE-2026-94390
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
🎖@cveNotify
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Hide Shipping Method For WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-95588
Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.
🎖@cveNotify
Patchstack
Arbitrary File Deletion in WordPress AcyMailing SMTP Newsletter Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-97258
Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.
🎖@cveNotify
Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Aruba Migration Tool Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-97260
Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress MaxGalleria Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-97268
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Premmerce Wishlist for WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-97269
Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.
🎖@cveNotify
Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.
🎖@cveNotify
Patchstack
Insecure Direct Object References (IDOR) in WordPress WPFunnels Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-97273
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Premmerce Wishlist for WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.