Vulnerabilities
Critical Arbitrary File Upload Flaw Found in CodeBard Help Desk Plugin
The National Vulnerability Database rates CVE-2026-62024 as critical, affecting CodeBard Help Desk versions up to 1.1.2 with unrestricted file upload risks.
Threat Times Exposure Desk
Vulnerabilities
DirectoryPress Plugin Vulnerable to Critical Unauthenticated File Inclusion
A critical flaw in DirectoryPress versions up to 3.6.27 allows unauthenticated local file inclusion, rated CVSS 9.8 by the NVD.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Stargaze WordPress Theme
The National Vulnerability Database lists CVE-2026-62051 as a critical flaw in Stargaze versions up to 1.10, allowing remote code execution.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Splendour WordPress Theme
The National Vulnerability Database lists CVE-2026-62050 as a critical flaw allowing remote code execution in Splendour versions up to 1.23.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Flaw Found in Tipsy Theme
The National Vulnerability Database rates CVE-2026-62052 as critical for Tipsy versions 1.6 and earlier due to unauthenticated injection risks.
Vulnerabilities
Critical PHP Object Injection Flaw Found in Wine House WordPress Theme
Unauthenticated attackers can exploit CVE-2026-62053 in Wine House versions up to 3.20 to achieve critical remote code execution.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Yacht Rental WordPress Theme
The National Vulnerability Database lists CVE-2026-62054 as a critical flaw allowing remote code execution in Yacht Rental versions up to 2.6.
Vulnerabilities
Unauthenticated PHP Object Injection Flaw Rated Critical in Kalles CMS
A critical vulnerability in Kalles CMS versions up to 1.1.7.1 allows unauthenticated attackers to inject PHP objects, posing significant security risks.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Flaw Found in Avala Plugin
The National Vulnerability Database lists CVE-2026-62077 as a critical severity issue affecting BoldThemes Avala versions up to 1.1.4.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Juno WordPress Theme
A severe vulnerability in the Juno WordPress theme allows attackers to execute code without authentication, affecting versions up to 2.25.
Vulnerabilities
Equadio WordPress Theme Faces Critical Unauthenticated PHP Object Injection Flaw
The National Vulnerability Database rates CVE-2026-62087 as critical, affecting Equadio versions up to 1.1.4 with a CVSS score of 9.8.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Flaw Found in WineShop <= 3.20
The NVD rates CVE-2026-62090 as critical, affecting WineShop versions up to 3.20 with a CVSS score of 9.8 due to unauthenticated PHP object injection vulnerabilities.
Vulnerabilities
Floci 1.1.0 to 2.2.0 Patched for Critical Unauthenticated Code Injection Flaw
A critical vulnerability in Floci allows unauthenticated attackers to execute OS commands via unrestricted Velocity mapping templates in the VtlTemplateEngine.
Vulnerabilities
Critical Path Traversal Flaw in rtMedia Plugin Exposes WordPress Sites to Data Breach
The National Vulnerability Database rates CVE-2026-105892 as critical, highlighting a severe security risk for users of the rtMedia plugin for WordPress and BuddyPress.
Vulnerabilities
Critical Privilege Escalation Flaw Found in miniOrange OTP Verification Plugin
The NVD assigned a CVSS score of 9.8 to CVE-2026-106610, a critical vulnerability allowing privilege escalation in miniOrange OTP verification versions up to 5.5.7.
Vulnerabilities
Tickera Event Ticketing System Patched for Critical SQL Injection Flaw
A critical SQL injection vulnerability in Tickera's event ticketing software affects versions up to 3.6.0.6, allowing attackers to perform blind SQL injection attacks.
Vulnerabilities
VillaTheme AFFI Plugin Has Critical Object Injection Vulnerability
A CVSS 9.8 flaw in VillaTheme AFFI – Affiliate Marketing for WooCommerce allows object injection through untrusted data deserialization.
Vulnerabilities
Critical Auth Bypass in cc-connect Webhooks Allows Remote Privileged Command Execution
Unauthenticated attackers can exploit CVE-2026-108549 in cc-connect through version 1.5.0 to run privileged commands on hosts via webhook forgery.
Vulnerabilities
openapi-typescript-codegen Critical Code Injection Flaw Exposes Devs to Arbitrary JS Execution
A critical vulnerability in openapi-typescript-codegen allows attackers to inject JavaScript via OpenAPI documents, affecting versions up to 0.31.0.
Vulnerabilities
PortSwigger Research Details CSS Injection Token Exfiltration via Overlapping Fragments
Security researchers have published a new technique that bypasses token length limits by splitting data into overlapping fragments for CSS-based exfiltration.
Vulnerabilities
WPCOM Member Plugin Critical Auth Bypass Lets Attackers Hijack Admin Accounts
A critical authentication bypass in the WPCOM Member WordPress plugin allows unauthenticated attackers to log in as any user, including administrators, through session forgery.
Vulnerabilities
Critical Deserialization Flaw Found in Travesia WordPress Theme Through Version 1.1.16
The National Vulnerability Database lists a CVSS 9.8 critical object injection vulnerability in ThemeREX Group Travesia, affecting versions up to 1.1.16.
Vulnerabilities
Critical Deserialization Flaw Found in Axiomthemes Veto Plugin Up to 1.6.0
The National Vulnerability Database rates CVE-2026-93927 as critical, warning that untrusted data deserialization allows object injection in Axiomthemes Veto.
Vulnerabilities
Critical Deserialization Flaw Found in ThemeREX Rosalinda WordPress Theme
A CVSS 9.8 vulnerability in the Rosalinda theme allows object injection, affecting versions up to 1.2.4 according to the National Vulnerability Database.