CVE watch

CVE-2026-104672 published: Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

CVE-2026-104747 published: Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

CVE-2026-104757 published: Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

CVE-2026-104387 published: Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

CVE-2026-104394 published: Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

CVE-2026-104395 published: Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

CVE-2026-104399 published: Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

CVE-2026-100518 published: Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

CVE-2026-102387 published: Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

CVE-2026-102915 published: Subscriber Broken Access Control in WPO365 <= 44.1 versions.

CVE-2026-103346 published: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

CVE-2026-104385 published: Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

CVE-2026-85153 published: This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package an...

CVE-2026-105807 published: A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.

CVE-2026-105305 published: A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the m...

CVE-2026-25302 published: Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.

CVE-2026-57537 published: Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.

CVE-2026-57545 published: Memory corruption when processing draw objects of incorrect type during graphics command list execution.

CVE-2026-57546 published: Transient DOS when processing a continuous receive command with a zero-sized global configuration override.

CVE-2026-25269 published: Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.