Fastify/rate-limit CVEs and Security Vulnerabilities

CVE-2026-16552

systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a CHASE_SAFE root-to-unprivileged ownership transition bypass

The reported issue is invalid, as it requires root privileges to reproduce, and it is out of scope of the threat model of the affected component.

CVSS 3.1 · 6.3 Medium EPSS n/a KEV · Not listed

Vendors

Redhat Systemd

Products

Enterprise Linux Hardened Images Openshift Container Platform and 1 more

CVE-2026-13069

Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB server by sending a crafted Queryable Encryption find payload containing an unvalidated field used to control an internal computation loop. The resulting resource exhaustion degrades availability for other operations.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Mongodb Server

CVE-2026-13056

A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with OOM error.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Mongodb Server

CVE-2026-59531

WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Anh Tran Wordpress

Products

Falcon – Wordpress Optimizations & Tweaks Wordpress

CVE-2026-59536

WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cocart Headless Wordpress

Products

Cocart – Headless Ecommerce Wordpress

CVE-2026-59537

WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Sender Wordpress

Products

Sender – Newsletter, Sms And Email Marketing Automation For Woocommerce Wordpress

CVE-2026-59548

WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Byteflows Wordpress

Products

Byteflows Travel & Hotel Booking Wordpress

CVE-2026-59552

WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Shahadat Hossain Wordpress

Products

3d Flipbook Pdf Viewer & Embedder Wordpress

CVE-2026-59557

WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Franky Wordpress

Products

Events Made Easy Wordpress

CVE-2026-59559

WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themewant Wordpress

Products

Rt Mega Menu – Mega Menu Builder For Elementor & Gutenberg Wordpress

CVE-2026-65433

WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themewant Wordpress

Products

Rt Mega Menu – Mega Menu Builder For Elementor & Gutenberg Wordpress

CVE-2026-65435

WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Thrive Themes Coupon Wordpress

Products

Thrive Leads Version Wordpress

CVE-2026-65558

WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpcenter

Products

Wordpress Affiliatex

CVE-2026-65561

WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange Wordpress

Products

Wordpress Social Login And Register Wordpress

CVE-2026-65563

WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle Wordpress

Products

Orbit Fox By Themeisle Wordpress

CVE-2026-65567

WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nexcess Wordpress

Products

Event Tickets Wordpress

CVE-2026-66434

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sayontan Sinha Wordpress

Products

Photonic Gallery & Lightbox For Flickr, Smugmug & Others Wordpress

CVE-2026-66442

WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Yaycommerce

Products

Wordpress Yaypricing

CVE-2026-66474

WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ht Plugins Wordpress

Products

Insert Headers And Footers Code – Ht Script Wordpress

CVE-2026-66475

WordPress Checkout Field Editor for WooCommerce – Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Acowebs Wordpress

Products

Checkout Field Editor For Woocommerce – Checkout Manager Wordpress

Search vulnerabilities

systemd: systemd-tmpfiles symlink-redirected arbitrary file overwrite via a CHASE_SAFE root-to-unprivileged ownership transition bypass

Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion

A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM

WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability

WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability

WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability

WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability

WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability

WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability

WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability

WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

WordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

WordPress Checkout Field Editor for WooCommerce – Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability