๐จ CVE-2026-108489
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
๐@cveNotify
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.
๐@cveNotify
Patchstack
Sensitive Data Exposure in WordPress Active Products Tables for WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-108490
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
๐@cveNotify
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.
๐@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Premium Addons for Elementor Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-108492
Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.
๐@cveNotify
Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.
๐@cveNotify
Patchstack
Broken Access Control in WordPress Quick Paypal Payments Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-108493
Missing Authorization vulnerability in Karolรญna Vyskoฤilovรก Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
๐@cveNotify
Missing Authorization vulnerability in Karolรญna Vyskoฤilovรก Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
๐@cveNotify
Patchstack
Broken Access Control in WordPress Pay for Payment for WooCommerce Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-108495
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.
๐@cveNotify
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.
๐@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress SureForms Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-108496
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23.
๐@cveNotify
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23.
๐@cveNotify
Patchstack
Broken Access Control in WordPress WP User Manager Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-109684
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
๐@cveNotify
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
๐@cveNotify
Patchstack
Broken Access Control in WordPress Amelia Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-109687
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
๐@cveNotify
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7.
๐@cveNotify
Patchstack
SQL Injection in WordPress Link Whisper Free Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-109691
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider โ Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider โ Addons For Elementor: from n/a through 4.7.1.
๐@cveNotify
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider โ Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider โ Addons For Elementor: from n/a through 4.7.1.
๐@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Prime Slider โ Addons For Elementor Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-109696
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.
๐@cveNotify
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.
๐@cveNotify
Patchstack
Broken Access Control in WordPress FluentBoards Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-109697
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.
๐@cveNotify
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.
๐@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress SureCart Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-109699
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
๐@cveNotify
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
๐@cveNotify
Patchstack
Broken Access Control in WordPress User Registration Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-102075
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.
๐@cveNotify
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The affected product web service does not properly validate user input in multipart handling. This could allow an unauthenticated remote attacker to cause a denial of service.
๐@cveNotify
๐จ CVE-2026-63350
Affected devices do not properly restrict executable content contained in imported trace files.
This could allow an attacker to social engineer an authorized user who holds the function right โRead diagnosticsโ into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the userโs browser session and perform PLC operations through the web server within the scope of the userโs authorization.
๐@cveNotify
Affected devices do not properly restrict executable content contained in imported trace files.
This could allow an attacker to social engineer an authorized user who holds the function right โRead diagnosticsโ into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the userโs browser session and perform PLC operations through the web server within the scope of the userโs authorization.
๐@cveNotify
๐จ CVE-2026-63355
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right โRead diagnosticsโ into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the userโs browser session when the user subsequently interacts with an affected selection menu.
๐@cveNotify
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right โRead diagnosticsโ into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the userโs browser session when the user subsequently interacts with an affected selection menu.
๐@cveNotify
๐จ CVE-2026-78557
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine
๐@cveNotify
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine
๐@cveNotify
๐จ CVE-2026-89198
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
๐@cveNotify
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
๐@cveNotify
๐จ CVE-2026-89203
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.
๐@cveNotify
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.
๐@cveNotify
๐จ CVE-2026-109832
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
๐@cveNotify
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
๐@cveNotify
Redhat
CVE-2026-109832 - Red Hat Customer Portal
CVE Details App
๐จ CVE-2026-63316
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks.
This issue was fixed in version 3.90.0 and 4.0.0-canary.34.
๐@cveNotify
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks.
This issue was fixed in version 3.90.0 and 4.0.0-canary.34.
๐@cveNotify
cert.pl
Podatnoลฤ w oprogramowaniu Payload CMS
W oprogramowaniu Payload CMS wykryto podatnoลฤ typu SQL Injection (CVE-2026-63316).
๐จ CVE-2026-94410
A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.
๐@cveNotify
A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.
๐@cveNotify
Certvde
Bender Customer&Partner Platform Vulnerability - Privilege Escalation