Threat database

CVE-2026-62066 is a high-severity vulnerability in CocoBasic Volos versions up to 1.2 that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This flaw can lead to remote file inclusion attacks, potentially resulting in full system compromise.

CVE-2026-62065 is a high-severity vulnerability in CocoBasic Cardea versions up to 2.3. It is an unauthenticated Local File Inclusion (LFI) issue caused by improper control of filenames used in include/require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to full system compromise.

CVE-2026-62064 is a high-severity Cross-Site Scripting (XSS) vulnerability affecting Bracketweb Ambed versions up to and including 1.0.0. This vulnerability allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

CVE-2026-62054 is a critical vulnerability in ThemeREX Yacht Rental versions up to 2.6 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62053 is a critical vulnerability in ThemeREX Wine House versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62052 is a critical vulnerability in ThemeREX Tipsy versions 1.6 and earlier that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62051 is a critical vulnerability in ThemeREX Stargaze versions up to 1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62050 is a critical vulnerability in ThemeREX Splendour versions up to 1.23 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62043 is a high-severity vulnerability in the sevenspark Contact Form 7 – Dynamic Text Extension plugin versions up to 5.0.7. It involves unauthenticated exposure of sensitive data due to insertion of sensitive information into sent data. This flaw allows an attacker without authentication to access sensitive information transmitted by the plugin.

CVE-2026-62038 is a high-severity authentication bypass vulnerability affecting DigitalME eRoom versions up to 1.7.1. It allows unauthenticated attackers to bypass authentication mechanisms, potentially leading to unauthorized access with limited confidentiality, integrity, and availability impact. No specific affected versions beyond <=1.7.1 are provided. There is no information on available patches or vendor advisories. The vulnerability is identified as CWE-288, indicating broken authentication via an alternate path or channel.

CVE-2026-62037 is a high severity unauthenticated Cross-Site Scripting (XSS) vulnerability in bPlugins Document Embedder versions up to 2.4.0. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication. The vulnerability is identified as CWE-79 and has a CVSS v3.1 score of 7.1, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided by the vendor. Users should monitor vendor advisories for updates and apply fixes once available.

CVE-2026-62035 is a medium severity vulnerability in the AWS S3 for WordPress Plugin – Upcasted affecting versions up to 3.1.0. It involves missing authorization controls (CWE-862), which could allow unauthorized access to subscriber-level functionality or data. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a moderate impact on confidentiality, integrity, and availability. A patch is available to address this issue.

CVE-2026-62034 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in the Before After Image Comparison – Image comparison for WP plugin for WordPress. It affects versions up to and including 1.1.21. The vulnerability allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability.

CVE-2026-62033 is a high-severity vulnerability in Stylemix uListing versions up to 2.2.0 that involves missing authorization controls. This flaw allows unauthorized changes to subscriber settings, potentially impacting confidentiality, integrity, and availability of the affected system.

CVE-2026-62032 is a critical vulnerability in Designinvento's DirectoryPress plugin versions up to and including 3.6.27. It allows unauthenticated local file inclusion due to improper control of filenames in include/require statements, classified under CWE-98. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62031 is a critical SQL Injection vulnerability affecting Stylemix uListing versions up to and including 2.2.0. It allows unauthenticated attackers to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and low availability impact, with no integrity impact reported.

CVE-2026-62030 is a high-severity Server-Side Request Forgery (SSRF) vulnerability affecting bPlugins StreamCast versions up to and including 2.4.5. This vulnerability allows unauthenticated attackers to induce the server to make arbitrary requests, potentially leading to limited confidentiality and integrity impacts. No official patch or remediation details are provided in the available data.

CVE-2026-62027 is a high-severity vulnerability in the bPlugins Team Section Block plugin, versions up to and including 2.0.4. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability.

CVE-2026-62025 is a critical vulnerability in Tailored Media's Tailored Tools product, versions up to and including 3.0.3. It allows unauthenticated attackers to upload arbitrary files with dangerous types, potentially leading to complete system compromise. The vulnerability is characterized as CWE-434, indicating unrestricted file upload of dangerous types. No specific affected versions beyond <=3.0.3 are provided. There is no information about available patches or vendor advisories. The CVSS 3.1 base score is 9.0, reflecting high attack complexity and severe impact on confidentiality, integrity, and availability.

CVE-2026-62024 is a critical vulnerability in CodeBard Help Desk versions up to 1.1.2 that allows arbitrary file upload of dangerous file types. This unrestricted upload flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.