CVEs

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable…

Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.

Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.

Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

Contributor Local File Inclusion in Vino <= 1.9 versions.

Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.

Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

Contributor SQL Injection in MapSVG <= 8.14.0 versions.

Contributor SQL Injection in MapSVG <= 8.14.0 versions.

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration

Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.