CVE-2026-40837

Authenticated SQLi in getProjectScalings function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40838

Authenticated SQLi in getDeviceScalings function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40839

Authenticated SQLi in getComponentScalings function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40841

Authenticated SQLi in getProjectTags function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40842

Authenticated SQLi in getWidgetTags function

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40847

Authenticated SQLi in system_tag view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40850

Unauthenticated SQLi in getAccountData function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40851

Command injection via USB

A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Rex100 Rex200 250 Mbnet and 2 more

CVE-2026-42760

WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.25.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Revmakx Wordpress

Products

Backup And Staging By Wp Time Capsule Wordpress

CVE-2026-42761

WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.9.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress

Products

Active Products Tables For Woocommerce Wordpress

CVE-2026-42734

WordPress Geo Mashup plugin <= 1.13.19 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through <= 1.13.19.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dylan Kuhn Wordpress

Products

Geo Mashup Wordpress

CVE-2026-42725

WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout Files Upload for WooCommerce: from n/a through <= 2.2.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpwham

Products

Wordpress Checkout Files Upload For Woocommerce

CVE-2026-42729

WordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows DOM-Based XSS.This issue affects PropertyHive: from n/a through <= 2.2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Propertyhive Wordpress

Products

Propertyhive Wordpress

CVE-2026-42727

WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.8.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Realmag777 Wordpress

Products

Active Products Tables For Woocommerce Wordpress

CVE-2026-8042

Github Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Octalmage Wordpress

Products

Github Shortcode Wordpress

CVE-2026-3896

Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

The Livemesh SiteOrigin Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `lsow_admin_ajax` AJAX action in all versions up to, and including, 3.9.2 due to missing authorization checks and insufficient input sanitization. The AJAX handler verifies a nonce but does not check user capabilities. This makes it possible for authenticated attackers with Subscriber-level access and above to modify plugin settings and inject malicious scripts that execute when administrators access the plugin settings page or when any user visits the frontend.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Livemesh Wordpress

Products

Livemesh Siteorigin Widgets Wordpress

CVE-2026-9574

itsourcecode Student Transcript Processing System trans.php sql injection

A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code of the file /admin/modules/student/trans.php. Executing a manipulation of the argument studentId/cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Student Transcript Processing System

CVE-2026-27331

WordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpTravelly: from n/a through 2.1.5.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Magepeople Wordpress

Products

Wptravelly Wordpress

CVE-2026-25444

WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Magepeopleteam Wordpress

Products

Wpbookingly Wordpress

CVE-2026-24520

WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress

Products

Tiktok Feed Plugin Wordpress