WordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.

WordPress Raider Spirit theme <= 1.1.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.

WordPress Corbesier theme <= 1.15.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.

WordPress Deliciosa theme <= 1.10.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.

WordPress SeaFood Company theme <= 1.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

WordPress Food Drop theme <= 1.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.

WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.

WordPress Wanium theme <= 1.9.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.

WordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Genemy <= 1.6.6 versions.

WordPress Kelly Young theme <= 1.1.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.

WordPress Top Dog theme <= 1.0.5 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.

WordPress Roneous theme <= 2.1.5 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.

WordPress Truemag theme <= 4.3.14.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.

WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

WordPress Thegov Core plugin < 2.0.23 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.

WordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it's a duplicate of CVE-2026-56784.

Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.

Central Dogma Git Mirror SSH Host Key Verification Missing Allowing Man‑in‑the‑Middle

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.

ZooKeeper Replication Default Secret Exposes Full Replication Log and Arbitrary Command Execution

A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back to a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, allowing an attacker with network access to read the full replication log or join the quorum and execute arbitrary replicated commands across the cluster.