CVE-2026-9197

Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export

The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nextendweb Wordpress

Products

Smart Slider 3 Wordpress

CVE-2026-7565

LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter

The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including, 4.1.4 via the 'import-user-file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress

Products

Learnpress – Backup & Migration Tool Wordpress

CVE-2026-2500

Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.4. This is due to the `qckply_data()` function passing the user-supplied `filename` POST parameter directly to `file_get_contents()` without any validation, sanitization, or path restriction. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files on the server, such as `wp-config.php` or `/etc/passwd`, which can contain sensitive information. Note: This vulnerability is only exploitable when the site has been synced with WordPress Playground (the `is_qckply_clone` option is set) or when running on `playground.wordpress.net`.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Davidfcarr Wordpress

Products

Quick Playground Wordpress

CVE-2026-8839

MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints

The MapPress Maps for WordPress plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.96.6. This is due to missing ownership verification in the REST API routes registered via `Mappress_Api::rest_api_init()`, where the GET `/wp-json/mapp/v1/maps/{mapid}` endpoint uses `'permission_callback' => '__return_true'` and the write endpoints (POST update, DELETE, PATCH mutate, POST clone, POST empty_trash) only check the generic `edit_posts` capability without confirming that the requester owns the targeted map — a gap that is not compensated at the model layer, as `Mappress_Map::get()`, `save()`, `delete()`, `mutate()`, and `empty_trash()` all operate on any caller-supplied map ID without an ownership check. This makes it possible for unauthenticated attackers to read sensitive map data — including POI titles, addresses, coordinates, and body content — for any map on the site by enumerating map IDs, and for authenticated attackers with Contributor-level access and above to modify, delete, trash/restore, or clone any map regardless of its author.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Chrisrichardson Wordpress

Products

Mappress Maps For Wordpress Wordpress

CVE-2026-9851

Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

The Booking Package plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in versions up to, and including, 1.7.16. This is due to a missing capability check on the 'updateUser' branch of the package_app_action AJAX endpoint, where the handler only validates a nonce and the dispatcher invokes Schedule::updateUser() with the $administrator argument hard-coded to 1, bypassing the only owner-restriction check inside that function and allowing the target user to be determined solely by attacker-supplied input passed directly to wp_update_user(). This makes it possible for authenticated attackers, with Editor-level access and above, to change the email address and password of any account, including Administrator accounts, resulting in a full site takeover.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Masaakitanaka Wordpress

Products

Booking Package Wordpress

CVE-2026-9829

Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcode Parameter in all versions up to, and including, 1.8.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The malicious payload is stored via the 'shortcode_bwg' AJAX handler — accessible to Contributor-level users and exploitable without a valid nonce by omitting the 'page' parameter — and is subsequently triggered by the unauthenticated 'bwg_frontend_data' AJAX handler, meaning successful exploitation requires only that an attacker has Contributor-level access to save the shortcode.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

10web Wordpress

Products

Photo Gallery By 10web – Mobile-friendly Image Gallery Wordpress

CVE-2026-1618

Admin Account Takeover in Universal Sotware's FlexCity/Kiosk

Authentication Bypass Using an Alternate Path or Channel vulnerability in Universal Software Inc. FlexCity/Kiosk allows Privilege Escalation. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Uni-yaz Universal Software Inc.

Products

Flexcity Flexcity/kiosk

CVE-2026-1619

IDOR in Universal Sotware's FlexCity/Kiosk

Authorization Bypass Through User-Controlled Key vulnerability in Universal Software Inc. FlexCity/Kiosk allows Exploitation of Trusted Identifiers. This issue affects FlexCity/Kiosk: from 1.0 before 1.0.36.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Uni-yaz Universal Software Inc.

Products

Flexcity Flexcity/kiosk

CVE-2026-1819

Stored XSS in Karel Electronics' ViPort

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Karel Electronics Industry and Trade Inc. ViPort allows Stored XSS. This issue affects ViPort: through 23012026.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Karel

Products

Viport

CVE-2026-2339

RCE in TUBITAK BILGEM's Liderahenk

Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion, Privilege Abuse, Command Injection. This issue affects Liderahenk: before 3.5.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Liderahenk

CVE-2026-2624

Authentication Bypass in ePati's Antikor NGFW

Missing Authentication for Critical Function vulnerability in ePati Cyber ​​Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentication Bypass. This issue affects Antikor Next Generation Firewall (NGFW): from v.2.0.1298 before v.2.0.1301.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed

Vendors

Epati Epati Cyber ​​security Technologies

Products

Antikor Next Generation Firewall Antikor Next Generation Firewall

CVE-2026-3120

RCE in Profelis Informatics' SambaBox

Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allows OS Command Injection. This issue affects SambaBox: from 5.1 before 5.3.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Profelis

Products

Sambabox

CVE-2026-5140

Authorization Bypass in TUBITAK BILGEM's Pardus Update

Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Authentication Bypass. This issue affects Pardus Update: from 0.6.3 before 0.6.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus

CVE-2026-5141

Improper Access Control in TUBITAK BILGEM's Pardus Software Center

Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process. This issue affects Pardus Software Center: from 1.0.2 before 1.0.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Software Center

CVE-2026-5161

Improper Authentication in TUBITAK BILGEM's Pardus About

Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack. This issue affects Pardus About: before 1.2.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus About

CVE-2026-5166

Path Traversal in TUBITAK BILGEM's Pardus Software Center

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Path Traversal. This issue affects Pardus Software Center: before 0.6.4.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Software Center

CVE-2026-6849

OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection. This issue affects Pardus OS My Computer: from <=0.7.5 before 0.8.0.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Os My Computer

CVE-2026-7382

Information Disclosure in MeWare Software's PDKS

Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc. PDKS allows Excavation. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Meware Software Development

Products

Pdks

CVE-2026-7399

IDOR in MeWare Software's PDKS

Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc. PDKS allows Privilege Abuse. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Meware Software Development

Products

Pdks

CVE-2026-7402

Improper Rate Limiting in MeWare Software's PDKS

Improper Control of Interaction Frequency vulnerability in MeWare Software Development Inc. PDKS allows Flooding. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Meware Software Development

Products

Pdks