🚨 CVE-2026-28569
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress SSL Zen Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32333
Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Mayosis Core Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32463
Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.
🎖@cveNotify
Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.
🎖@cveNotify
Patchstack
Arbitrary File Upload in WordPress Sync Post With Other Site Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32464
Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.
🎖@cveNotify
Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.
🎖@cveNotify
Patchstack
Local File Inclusion in WordPress Theme Test Drive Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32465
Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
🎖@cveNotify
Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
🎖@cveNotify
Patchstack
PHP Object Injection in WordPress Essential Real Estate Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32466
Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.
🎖@cveNotify
Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.
🎖@cveNotify
Patchstack
SQL Injection in WordPress Gravity Forms Bookings premium Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32467
Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.
🎖@cveNotify
Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.
🎖@cveNotify
Patchstack
Server Side Request Forgery (SSRF) in WordPress [Aotuman] Grab WeChat Articles Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32468
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress Duitku Payment Gateway Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-50575
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.
🎖@cveNotify
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.
🎖@cveNotify
GitHub
fix(security): close GHSA-3v82-3gf8-fxx8 deleted-peer replay chain · UNITRONIX/BetterDesk@f3b4df2
Soft-deleted peers were silently restored by any subsequent registration, and the registration path bypassed enrollment policy for them. Combined with GetPeer filtering out soft-deleted rows, this ...
🚨 CVE-2026-18534
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
🎖@cveNotify
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
🎖@cveNotify
arc.net
Security Bulletin
Experience a calmer, more personal internet in this browser designed for you. Let go of the clicks, the clutter, the distractions.
🚨 CVE-2026-32472
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Online Contact Widget Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32473
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
🎖@cveNotify
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
🎖@cveNotify
Patchstack
Server Side Request Forgery (SSRF) in WordPress PDF Smart Viewer for Elementor Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-32553
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.
🎖@cveNotify
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.
🎖@cveNotify
Patchstack
Server Side Request Forgery (SSRF) in WordPress OttoKit Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-45733
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.
🎖@cveNotify
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.
🎖@cveNotify
GitHub
fix(client): sanitize icon classes · TriliumNext/Trilium@c069394
Build your personal knowledge base with Trilium Notes - fix(client): sanitize icon classes · TriliumNext/Trilium@c069394
🚨 CVE-2026-48798
SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.
🎖@cveNotify
SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.
🎖@cveNotify
GitHub
Reject unsafe server-supplied names in SCP recursive download · sshnet/SSH.NET@600be0d
A malicious or compromised SCP server could return file or directory names containing
path separators, drive qualifiers, or parent-directory references.
ScpClient.Download(string, DirectoryInfo) co...
path separators, drive qualifiers, or parent-directory references.
ScpClient.Download(string, DirectoryInfo) co...