🚨 CVE-2026-27345
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

🎖@cveNotify

🚨 CVE-2026-27380
Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

🎖@cveNotify

🚨 CVE-2026-27535
Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

🎖@cveNotify

🚨 CVE-2026-27536
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

🎖@cveNotify

🚨 CVE-2026-27537
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

🎖@cveNotify

🚨 CVE-2026-27538
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

🎖@cveNotify

🚨 CVE-2026-27539
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

🎖@cveNotify

🚨 CVE-2026-27543
Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

🎖@cveNotify

🚨 CVE-2026-27544
Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

🎖@cveNotify

🚨 CVE-2026-27999
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

🎖@cveNotify

🚨 CVE-2026-28002
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection.

This issue affects Booktics: from n/a through 1.0.22.

🎖@cveNotify

🚨 CVE-2026-28003
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

🎖@cveNotify

🚨 CVE-2026-28004
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

🎖@cveNotify

🚨 CVE-2026-28008
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

🎖@cveNotify

🚨 CVE-2026-28142
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

🎖@cveNotify

🚨 CVE-2026-28148
Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

🎖@cveNotify

🚨 CVE-2026-28149
Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

🎖@cveNotify

🚨 CVE-2026-28155
Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

🎖@cveNotify

🚨 CVE-2026-28156
Subscriber SQL Injection in Do Lasso <= 358 versions.

🎖@cveNotify

🚨 CVE-2026-28157
Subscriber Path Traversal in Do Lasso <= 358 versions.

🎖@cveNotify

🚨 CVE-2026-28158
Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

🎖@cveNotify