| CVE-2026-88801 | HOCH8.0 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticated user, such as a subscriber, to inject arbitrary web scripts | 06/11/2026 |
| CVE-2026-88800 | KRITISCH9.1 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, al | 06/11/2026 |
| CVE-2026-88799 | HOCH8.8 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password and email address of any other account including an administ | 06/11/2026 |
| CVE-2026-65022 | MITTEL6.3 | The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the crafted content. | 06/11/2026 |
| CVE-2026-39744 | HOCH7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Stored XSS.This issue affects WCFM Membership: from n/a through 2.12.0. | 06/11/2026 |
| CVE-2026-121824 | HOCH8.7 | A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memory allocation, potentially resulting in denial of service. | 06/11/2026 |
| CVE-2026-121823 | HOCH8.7 | A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthenticated attackers to bypass path-based access controls and access protected resources. | 06/11/2026 |
| CVE-2026-121822 | NIEDRIG2.4 | A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting (XSS) when directory listing is enabled and a user views the listing. | 06/11/2026 |
| CVE-2026-121821 | MITTEL5.3 | A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not enforce configured path restrictions, allowing an attacker-controlled website visited by an authenticated victim to read sensitive responses from excluded paths when credentials are enabled and the victi | 06/11/2026 |
| CVE-2026-121820 | HOCH8.7 | A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-supplied SAML messages without limiting the output size before signature validation, allowing an unauthenticated remote attacker to exhaust server memory and cause a denial of serv | 06/11/2026 |
| CVE-2026-121819 | MITTEL5.9 | A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filename containment without resolving symbolic links, allowing a compromised or semi-trusted xDS control plane to cause the xDS client to read files outside configured allowed root directories when a symbol | 06/11/2026 |
| CVE-2026-121636 | MITTEL5.3 | The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment. | 06/11/2026 |
| CVE-2026-121633 | MITTEL5.3 | The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to the | 06/11/2026 |
| CVE-2026-121006 | — | HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.
Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines.
A remote attack | 06/11/2026 |
| CVE-2026-120844 | KRITISCH9.8 | Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3. | 06/11/2026 |
| CVE-2026-119516 | KRITISCH9.8 | Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20. | 06/11/2026 |
| CVE-2026-119499 | HOCH7.5 | Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4. | 06/11/2026 |
| CVE-2026-119488 | HOCH7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15. | 06/11/2026 |
| CVE-2026-119472 | MITTEL6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16. | 06/11/2026 |
| CVE-2026-118423 | KRITISCH10.0 | The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution. | 06/11/2026 |