SQL injection in the MapSVG WordPress plugin (versions <= 8.14.0) allows an authenticated user holding at least Contributor privileges to inject arbitrary SQL into backend database queries (CWE-89). Reported by Patchstack and rated CVSS 8.5, the flaw enables extraction of sensitive database contents such as WordPress user records and password hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.
SQL injection in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets an authenticated Contributor-level user inject arbitrary SQL and read backend database contents. Reported by Patchstack and rated CVSS 8.5, the flaw carries a scope change (S:C) meaning the injected query can reach data beyond the plugin's own boundary. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low attacker prerequisites make it a credible risk on any multi-author site running the plugin.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run attacker-controlled code through the configured interpreter before the developer grants project trust, bypassing the IDE's trust-gate safeguard. Tagged as RCE by the reporting vendor (JetBrains), the flaw carries a CVSS 8.4 and requires a developer to open a crafted project locally. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run code through project tooling before the user grants project trust, bypassing the IDE's trust-boundary safeguard. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, it lets an attacker who tricks a developer into opening a crafted repository execute code in the developer's context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the local high-impact (C:H/I:H/A:H) nature makes it relevant for developer-workstation threat models.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code through the configured Node.js interpreter before the developer grants the project the required trust. Any developer who opens (or clones and opens) an attacker-supplied project is affected, since the IDE's trust prompt - designed to gate execution - is bypassed. No public exploit has been identified and it is not in CISA KEV, but the RCE and Node.js tags plus a local, no-privilege CVSS 8.4 vector make this a meaningful supply-chain/developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 lets a malicious project run code on a developer's machine before the IDE's project-trust prompt is ever answered, by abusing project-local package-manager tooling that the IDE invokes automatically. Because execution happens prior to the trust gate, the safety boundary meant to protect users who merely open an untrusted repository is bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the RCE tag and full C/I/A impact make this a meaningful developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code via project-local linter tooling before the user grants project trust, bypassing the IDE's Trust Projects safeguard. The flaw (CWE-829) affects developers who open or import a crafted repository; no public exploit or active exploitation has been identified, and no EPSS/KEV signal is present in the provided data. Fixed in WebStorm 2026.2.
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v1/web/fetch endpoint to make the server retrieve arbitrary internal URLs and return their content. Because the user-supplied url is only checked for syntactic validity via new URL() before being handed to an external scraping provider, an attacker can reach cloud metadata endpoints (169.254.169.254), link-local/private addresses, and localhost-only services, harvesting credentials and bypassing host-based auth. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.3 reflects high confidentiality impact with a scope/subsequent-system change.
Use-after-free in Chrome's Input component enables an attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. Affected versions span all Google Chrome releases prior to 150.0.7871.186 across Windows, macOS, and Linux. Successful exploitation grants code execution outside the sandbox with the full privileges of the browser process on the underlying host. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS stands at 0.25% (16th percentile), consistent with no observed in-the-wild activity.
Broken access control in the Grav API Plugin before 1.0.10 lets authenticated users holding the api.config.write privilege modify security-critical configuration scopes they should not control, specifically site-wide rate limiting and CORS policy. An attacker can switch off rate limiting to enable unthrottled credential brute-forcing and add attacker-controlled origins to CORS with credentials enabled, weakening the site's authentication and cross-origin defenses. No public exploit identified at time of analysis; the issue is rated CVSS 4.0 8.2 (High) and classified as CWE-862 Missing Authorization.
Unauthenticated information disclosure in the Convert Forms extension for Joomla (versions 2.5.0 through 5.2.2) lets any anonymous visitor enumerate and read a form's stored submissions because the front-end Submissions view fails to enforce access control. Submitted data frequently contains PII such as names, email addresses, phone numbers, and free-text messages, so exposure can be significant. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Insufficient permission and CSRF token checks in the Modules Anywhere editor popup for Joomla allow authenticated users to view and modify restricted module data without proper authorization. The vulnerability affects all versions up to 8.4.1. No public exploit code or active exploitation is known at this time; the EPSS exploitation probability is low.
Authentication bypass in the miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) lets remote unauthenticated attackers defeat the plugin's identity verification (CWE-288) and assume the identity of legitimate WordPress users, including potentially privileged accounts. Rated CVSS 8.1 (High) by Patchstack, the flaw carries full confidentiality, integrity, and availability impact but a high attack complexity that tempers real-world exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege-relevant OS command injection in pardus-update (the update manager component of the Turkish national Debian-based distribution Pardus) affects versions 0.6.6 up to but not including 0.7.0, allowing an authenticated local user to inject and execute arbitrary operating system commands via improperly neutralized special characters. Because update tooling typically runs with elevated privileges, successful exploitation can yield full confidentiality, integrity, and availability compromise of the host. Reported by Turkey's national CSIRT (TR-CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Unistal Protegent 360 v2.0.0.4 allows a low-privileged local attacker to gain SYSTEM-level privileges via the kernel driver pgsecdl.sys. A proof-of-concept exploit is available, but no active exploitation has been confirmed (no CISA KEV listing). EPSS scores indicate a low probability of exploitation in the wild (0.24%).
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-controlled code via the configured Go SDK before the user grants project trust, bypassing the trust-boundary safeguard meant to gate execution. Any developer who merely opens a crafted repository (for example, cloned from a public source) can be compromised without ever clicking 'Trust Project'. This is a CWE-94 code injection weakness with a CVSS 7.8; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code through the Go Modules integration before the developer explicitly grants project trust. Because the trust prompt is meant to be the safeguard against exactly this, opening or previewing a crafted repository is sufficient for compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in JetBrains IntelliJ IDEA before 2026.2 allows a malicious project to run attacker-controlled code before the user grants project trust, by abusing development container (dev container) configuration that the IDE processes prematurely. Any developer who opens or clones a crafted repository is affected, since code executes ahead of the trust prompt that is supposed to gate untrusted projects. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the local, low-complexity nature and RCE tagging make it a meaningful supply-chain-of-code risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run attacker-controlled code on a developer's machine by supplying a crafted linter configuration that the IDE trusts and executes when the project is opened. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, the flaw carries CVSS 7.8 (high) with a local vector and required user interaction. There is no public exploit identified at time of analysis and no CISA KEV listing, indicating no confirmed active exploitation to date.
Out-of-bounds memory access in Apple swift-nio-ssl allows information disclosure and denial of service when parsing X.509 certificates with non-ASN1_STRING Subject Alternative Names. The vulnerability affects versions prior to 2.37.2 and can be triggered locally by a crafted certificate, leading to potential data leakage or process crash. Public proof-of-concept code exists, but no active exploitation has been reported at this time.
Arbitrary file deletion in the Kali Forms WordPress plugin (versions 2.4.18 and earlier) lets a low-privileged authenticated user - as low as a Subscriber - delete arbitrary files on the server via path traversal. On sites that allow open registration, an attacker can self-provision an account and remove critical files such as wp-config.php, knocking the site offline or forcing it into a fresh-install state. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
Path-traversal-based middleware bypass in @fastify/static versions up to and including 10.1.0 lets an unauthenticated remote attacker use dot-dot (../) path segments to reach files inside the static root that were meant to be protected by route-scoped middleware. This is a regression bypass of the earlier CVE-2026-6414 fix, which only blocked encoded forward slashes; the underlying send library normalizes dot segments before its own guard runs, defeating route-guard filtering. No public exploit has been identified at time of analysis, and the flaw is fixed in 10.1.1.
Authenticated SQL injection in the Persian Woocommerce SMS WordPress plugin (versions 7.2.2 and earlier) lets a user holding the Shop Manager role inject arbitrary SQL into backend queries, enabling extraction of sensitive database contents such as customer PII, order data, and WordPress credential hashes. Reported by Patchstack and classified CWE-89, the flaw carries a CVSS 7.6 score driven by network reach and high confidentiality impact but gated behind privileged access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the Uncanny Automator WordPress plugin (versions 7.3.2 and earlier) lets an authenticated administrator inject arbitrary SQL into backend database queries. Reported by Patchstack and scored CVSS 7.6, the flaw carries a confidentiality-heavy impact (C:H) but requires high privileges (PR:H), so the realistic threat is a compromised or rogue admin account rather than an anonymous internet attacker. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Lumise Product Designer for WooCommerce WordPress plugin (versions up to and including 2.1.1) allows unauthenticated attackers to extract sensitive database contents by manipulating the 'id' and 'table' parameters inside an uploaded cart JSON file processed by the checkout AJAX action. The flaw stems from unescaped interpolation into a raw SQL query in the find_resource() function, letting attackers append their own SELECT logic. No public exploit is identified at time of analysis, and the CVSS 7.5 rating reflects high confidentiality impact with no integrity or availability effect.
Remote denial of service in find-my-way (the HTTP router underneath Fastify) affects all versions up to and including 9.6.0 when the router serves requests from a Node.js HTTP/2 server. Because the internal method-to-tree map is a plain JavaScript object, an unauthenticated attacker can send a request whose HTTP method is an inherited Object property name such as constructor, toString, or __proto__, causing find() to treat a prototype value as a router node and crash the process on currentNode.prefix.length. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trigger is trivial and a fixed release (9.7.0) is available.
Remote memory-exhaustion denial of service in the Quinn Rust QUIC library (quinn-proto 0.1.0 through 0.11.14) lets an unauthenticated peer flood a connection with many small, non-contiguous stream fragments that leave gaps at the start of the stream. Because the in-order Assembler cannot defragment these gapped chunks, buffer overhead grows unbounded and the receiving process can be driven to exhaust memory. CVSS 7.5 (availability-only); no public exploit identified at time of analysis, but the fix and root cause are fully documented in the upstream advisory and PR.
Denial of service in OpenPrinting libcupsfilters (as shipped in Red Hat Enterprise Linux 7 through 10) allows a network-adjacent attacker to pin a CPU at 100% by broadcasting a crafted printer advertisement. The flaw lies in cfIEEE1284NormalizeMakeModel(), which enters an infinite loop (CWE-835) when parsing an IEEE-1284 device ID whose model field is empty. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; impact is limited to availability with no data compromise.
Denial of service in Apple's swift-crypto (all versions before 4.5.1) allows remote attackers to crash a process by supplying malformed RSA public key bytes. When BoringSSL fails to decode a DER- or PEM-encoded RSA public key, the underlying EVP_PKEY* is freed twice - once in the error catch block and again during deinitialization - corrupting the allocator and causing a crash on subsequent memory allocations. No public exploit identified at time of analysis; the flaw is memory-safety corruption limited to availability impact (CVSS 7.5).
Unauthenticated remote file disclosure in ReReplacer Pro extension for Joomla allows attackers to read arbitrary files outside the site directory via path traversal in XML include paths. The vulnerability affects versions 1.0.0 through 15.0.3 and has a CVSS 3.1 score of 7.5 (high confidentiality impact). No public exploit code or active exploitation has been reported, and EPSS indicates a very low probability of widespread exploitation.
Server-side request forgery in Regular Labs' Articles Anywhere Pro and Users Anywhere Pro extensions for Joomla allows unauthenticated attackers to access internal network services and write arbitrary files to web-accessible directories. The vulnerability stems from improper validation of content-controlled image URLs, which fetch and save remote responses without checking that they are images. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability.
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in request URLs. Unauthenticated remote attackers can intercept these credentials from network traffic or server logs, gaining unauthorized access to the victim’s MaxMind geolocation service. No active exploitation or public exploit code is known, and EPSS probability of exploitation is very low (0.19%).
Session replay in Logto IdP-initiated SAML sessions allows unauthenticated remote attackers to reuse captured session tokens, leading to unauthorized account access. Affected versions 1.21.0 through 1.37.1 silently fail to delete sessions, enabling replay within the session's validity window. No active exploitation confirmed but the attack requires no user interaction, and EPSS indicates very low exploitation likelihood.
Remote attackers can bypass SAML assertion time and audience restrictions in Logto versions 1.12.0 through 1.37.1, enabling indefinite replay of modified assertions and unauthorized persistent access. No active exploitation or public exploit code has been identified, and EPSS indicates a low exploitation probability (0.13%).
Sensitive information disclosure in the pixelacehq "Manual" WordPress theme (versions 7.5.4 and earlier) lets remote unauthenticated attackers reach functionality or data that should be access-restricted, due to a missing authorization check (CWE-862). Rated CVSS 7.5 with a confidentiality-only impact, the flaw was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in Dokan Pro (the premium extension of the Dokan multivendor marketplace plugin for WordPress) through version 5.0.3 lets unauthenticated remote attackers reach functionality that should be authorization-gated, per Patchstack's advisory. The published CVSS vector scores only an availability impact (C:N/I:N/A:H), indicating the missing authorization check can be abused to disrupt or degrade marketplace operations rather than to read or alter data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
PHP Object Injection in the Dokan Pro WordPress plugin (versions 5.0.2 and earlier) allows an authenticated user holding only subscriber-level privileges to inject a crafted serialized PHP object, which - if a suitable gadget chain exists in the plugin or its dependencies - can lead to high-impact compromise of confidentiality, integrity, and availability. Reported by Patchstack and tracked as CVE-2026-65493 (CWE-502), it carries a CVSS 3.1 score of 7.5 with high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.
Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Integrity compromise in the PayU India WordPress plugin (versions 3.8.9 and earlier) allows remote unauthenticated attackers to abuse functionality protected only by a missing authorization check. Reported by Patchstack, the flaw lets attackers reach privileged plugin actions without credentials, enabling manipulation of payment-related state or configuration. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in the WordPress WPDM - Premium Packages plugin (versions 6.2.0 and earlier) allows remote unauthenticated attackers to reach functionality or data that should require authorization, due to a missing access-control check. Reported by Patchstack and rated CVSS 7.5 (confidentiality-only impact), the flaw needs no credentials or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broken access control in the Payment Gateway for PayPal on WooCommerce WordPress plugin (versions <= 9.1.4) lets remote unauthenticated attackers tamper with integrity-sensitive data due to a missing authorization check. Reported by Patchstack and tagged as an authentication bypass, the flaw exposes protected plugin functionality without any login. No public exploit code and no CISA KEV listing were identified at time of analysis.
Out-of-bounds heap write in FFmpeg's vf_floodfill video filter (versions 3.4 through 8.1.2) lets an attacker corrupt heap memory by feeding a specially crafted, dynamically sized video stream to a filtergraph where reinitialization is disabled via -reinit_filter 0. Reported by VulnCheck with a vendor patch available and no public exploit identified at time of analysis, the flaw reliably crashes the process and carries potential for code execution depending on heap layout and process hardening. Exploitation is local and requires the victim to process attacker-supplied media through the specific floodfill configuration.
Out-of-bounds heap write in FFmpeg through 8.1.2 lets an attacker who supplies a crafted ffconcat file - processed with the -safe 0 flag - corrupt heap memory and potentially achieve code execution. The flaw chains the TY demuxer's demux_audio() (which decrements packet size without bounds checking) into the Shorten decoder's memcpy(), where a negative size wraps to near SIZE_MAX. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis.
Stored cross-site scripting in the FormCraft WordPress plugin (all versions through 3.9.14) lets unauthenticated attackers persist malicious JavaScript that executes in any user's browser when an affected page is rendered. The flaw stems from a two-sided sanitization gap: composite matrix sub-field keys (e.g. field2_0) are written raw via $wpdb->insert(), and the client-side DOMPurify guard is skipped because matrix values arrive as arrays rather than strings. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but its unauthenticated, network-reachable nature (CVSS 7.2) makes it a meaningful patch priority for exposed sites.
Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticated attackers persist arbitrary JavaScript through submitted 'password' field values, which later executes in the browser of any user who loads the affected page. Because the injection point is a public-facing form and no authentication is required, the flaw is well-suited to opportunistic, automated abuse against WordPress sites running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.2 (scope-changed) rating and unauthenticated vector make it a meaningful patch priority.
Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the `/wp-json/wc-srp/v1/earning` REST endpoint. A broken `user_has_cap` filter hands the `rs_earning_read` capability to everyone, so an attacker can write an unsanitized `reason` value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.