CVE-2026-65907
— JetBrains TeamCity Remote Code Execution Vulnerability
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65906
— JetBrains TeamCity Kotlin DSL Sandbox Escape Code Execution
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-15037
— XML injection vulnerability in QDom comment, CDATA and processing-instruction serializati…
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application in…
Remote
|
Injection
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65897
— Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that g…
grav
|
Remote
|
Authorization
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65896
— Grav API Plugin before 1.0.10 Path Traversal via move
Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug…
grav
|
Remote
|
Path Traversal
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limi…
grav
|
Remote
|
Authorization
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65608
— Grav before 2.0.9 Remote Code Execution via FlexDirectory
Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on at…
grav
|
Remote
|
Injection
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65607
— SiYuan before v3.7.2 Path Traversal via /export/temp/
SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch …
Remote
|
Path Traversal
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the applic…
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65605
— SiYuan before v3.7.2 Stored XSS to RCE via Attribute View
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escap…
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65550
— WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability
Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65540
— WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CS…
Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions.
Remote
|
Cross-Site Request Forgery
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65539
— WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.
Remote
|
Cross-Site Request Forgery
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65538
— WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65537
— WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 -…
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
Remote
|
Authorization
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65536
— WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cr…
Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.
Remote
|
Cross-Site Request Forgery
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65535
— WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability
Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.
Remote
|
Information Disclosure
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65534
— WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting…
Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65533
— WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
Remote
|
Cross-Site Scripting
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
CVE-2026-65532
— WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability
Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
Remote
|
Injection
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
Jul 23, 2026
