CVE-2026-60041 is a vulnerability that allows an unauthenticated remote attacker to perform a Cross-Site Request Forgery (CSRF) attack on a logged-in backend user. This attack can lead to execution of critical system actions such as shutting down the server or restoring an uploaded backup, resulting in loss of system integrity and availability.
CVE-2026-60038 is a vulnerability in the ImportPKCS12 function of OpenSSL backends that allows a high privileged remote attacker to perform code injection, potentially leading to full compromise of confidentiality, integrity, and availability.
A vulnerability in the keycloak-services component of Keycloak allows skipping mandatory Proof Key for Code Exchange (PKCE) security checks when a user initiates login after visiting the password reset page. This flaw enables an attacker who intercepts a login code to exchange it for tokens and impersonate the user without the required PKCE verifier. Exploitation requires the victim to follow a specific sequence of pages and the attacker to intercept the authorization code. No effective mitigation or patch is currently available according to the vendor advisory.
CVE-2026-60036 is a vulnerability that allows a high privileged remote attacker to perform code injection via the backends patch activate function, potentially leading to full system compromise including loss of confidentiality, integrity, and availability.
CVE-2026-60039 is a vulnerability that allows a high privileged remote attacker to perform code injection via the backend's backup restore function. Successful exploitation can lead to code execution, resulting in complete loss of confidentiality, integrity, and availability of the affected system.
A vulnerability in the Cargo Shipping Location plugin for WooCommerce WordPress versions before 6.0 allows unauthenticated users to manipulate order shipment statuses via a REST API endpoint due to improper access restrictions and reliance on attacker-controllable authorization values.
CVE-2026-60042 is a vulnerability where an unauthenticated remote attacker can bypass authentication in the com_check function. This bypass may cause increased system traffic and trigger email alerts, potentially leading to reduced availability due to higher system loads. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-60040 is a vulnerability that allows an unauthenticated remote attacker to cause a denial of service (DoS) by exploiting the backend's backup creation function, resulting in total loss of availability.
The Everest Forms WordPress plugin up to version 3.6.2 contains a file deletion vulnerability in the remove_csv_file_after_email_send function. This flaw allows unauthenticated attackers to delete files within the wp-content/uploads directory when the Save-and-Continue addon is active and a specific form setting is enabled. Under certain conditions, attackers may also delete critical files like uploads/.htaccess, potentially re-enabling PHP execution in the uploads directory. Rarely, deletion of files outside the uploads directory may be possible.
CVE-2026-60035 is a vulnerability that allows a high privileged remote attacker to perform code injection in the backend's network authentication function. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected system.
The FraudLabs Pro SMS Verification WordPress plugin versions through 1.12.1 contain a vulnerability where the SMS-retry limit is not enforced on the server side. This flaw allows unauthenticated users to send unlimited verification SMS messages to arbitrary phone numbers, potentially exhausting the site owner's paid SMS credits and causing spam to third parties.
The Ultra Addons for Contact Form 7 WordPress plugin is vulnerable to a directory traversal flaw in all versions up to and including 3.5.54. This vulnerability allows unauthenticated attackers to read arbitrary files on the server via the uacf7_wpcf7_mail_components function. Exploitation requires the PDF Generator addon to be active and a PDF body template configured by an administrator for the targeted contact form.
The ARMember Premium WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the Registration Custom Field (Profile Cover) due to insufficient input sanitization and output escaping. This vulnerability affects all versions up to and including 7.8.1 and allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Avada (Fusion) Builder plugin for WordPress up to version 3.16.1 is vulnerable to stored cross-site scripting (XSS) via the Form Notification Dynamic-Data action_hook. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires specific conditions involving Fusion Forms and Post Cards elements on admin-authored and publicly accessible pages.
The WPML Multilingual CMS plugin for WordPress versions up to and including 4.9.7 contains an authentication bypass vulnerability due to a race condition in its single sign-on (SSO) mechanism. This flaw allows unauthenticated attackers to forge authentication tokens during the victim's logout process, potentially gaining unauthorized access to user accounts, including administrators. The vulnerability arises because the cross-domain sign-in token can be derived without user authentication and is not properly bound to the logout action or client, enabling token reuse within a short time window.
CVE-2026-104619 is a vulnerability in PackageKit's Zypp Backend versions before 1.4.1 that allows untrusted users to roll back security updates. This rollback can lead to privilege escalation by reverting to older, less secure versions. The issue is fixed in PackageKit version 1.4.1.
An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted.
CVE-2026-60045 is a vulnerability in MB connect line's mbCONNECT24 product that allows a high privileged remote attacker to upload arbitrary files to a guessable location. This unrestricted file upload can lead to loss of availability and may be exploited in combination with other vulnerabilities. The issue affects versions from 2.0.0 up to but not including 2.21.0 and has been fixed in version 2.21.0.
mbCONNECT24 versions from 2.0.0 up to but not including 2.21.0 contain a vulnerability where backups are protected by a weak static password. This allows unauthenticated remote attackers to access backup contents, resulting in total loss of confidentiality. The issue is fixed in version 2.21.0.
CVE-2026-60043 is a cross-site scripting (XSS) vulnerability in MB connect line's mbCONNECT24 product versions 2.0.0 up to but not including 2.21.0. An unauthenticated remote attacker can exploit this flaw to execute scripts in the context of a logged-in backend user, potentially triggering critical system actions such as server shutdown or backup restoration. This vulnerability impacts system integrity and availability. A fix is available starting with version 2.21.0.