CVE-2026-16977

Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

10web Wordpress

Products

Form Maker By 10web Wordpress

CVE-2026-18046

Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a subscriber to overwrite the stored key and disrupt the Cookie Consent WordPress plugin before 0.0.10's geolocation-based consent banner targeting.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cookie Consent Project Wordpress

Products

Cookie Consent Wordpress

CVE-2026-49349

regclient may leak authentication credentials to external blob stores

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Regclient

Products

Regclient

CVE-2021-32087

Hard‑coded FTP Credential Enables Remote Privilege Escalation in Quest KACE SMA

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Quest

Products

Kace Systems Deployment Appliance Kace Systems Management Appliance

CVE-2026-20760

Privilege Escalation via Improper Memory Range Handling in Intel Microcode

Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring 0: Hypervisor may allow an escalation of privilege. Authorized adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Intel Processors

CVE-2026-28729

Integer Overflow in Intel Slim Bootloader UEFI Firmware Leading to Information Disclosure and Denial of Service

Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (none) and availability (low) impacts.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Slim Bootloader

CVE-2025-35973

kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling

Improper handling of values for some Intel(R) Processors within Ring 0: Kernel, Hypervisor and Bare Metal OS may allow an escalation of privilege. Authorized adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and require no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.

CVSS 4.0 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Intel Processors

CVE-2026-0465

Local Use‑After‑Free in AMD Ryzen Master Utility Driver Allows Kernel Memory Access

A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potentially resulting in loss of availability

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Ryzen Master Ryzen Master Monitoring Sdk

CVE-2026-20917

Exposure of Sensitive Information via Incorrect Transient Execution Data Forwarding in Intel Processors

Exposure of sensitive information caused by incorrect data forwarding during transient execution for some Intel(R) Processors within Ring 0: Hypervisor and Kernel may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

CVSS 4.0 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Intel

Products

Intel Processors

CVE-2026-73243

kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Keking

Products

Kkfileview

CVE-2026-16066

Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Welcart Wordpress

Products

Welcart E-commerce Wordpress

CVE-2026-16294

Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Blubrry Wordpress

Products

Powerpress Podcasting Plugin By Blubrry Wordpress

CVE-2026-16737

WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wptravelengine

Products

Wordpress Wp Travel Engine

CVE-2026-17013

WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Photo Album Plus Project

Products

Wordpress Wp Photo Album Plus

CVE-2026-18035

User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

User Access Manager Project Wordpress

Products

User Access Manager Wordpress

CVE-2026-18048

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Photo Album Plus Project

Products

Wordpress Wp Photo Album Plus

CVE-2026-18049

WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Photo Album Plus Project

Products

Wordpress Wp Photo Album Plus

CVE-2026-18057

Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Events Manager Project Wordpress

Products

Events Manager Wordpress

CVE-2026-18230

WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdirectorykit

Products

Wordpress Wp Directory Kit

CVE-2026-18366

Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Events Manager Project Wordpress

Products

Events Manager Wordpress