Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.9 CVE-2026-47365

CVE-2026-47365_CVE-2026-47365

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tena...

WebPros WordPress-Toolkit CVE
CRITICAL 9.8 CVE-2026-49060

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability_CVE-2026-49060

Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile Ap...

Hippoo Hippoo Mobile App for WooCommerce n/a CVE
CRITICAL 9.3 CVE-2026-42647

WordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerability_CVE-2026-42647

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection....

Beardev JoomSport n/a CVE
CRITICAL 9.3 CVE-2026-39494

WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability_CVE-2026-39494

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blin...

WBW Plugins Product Filter by WBW n/a CVE
CRITICAL 9.3 CVE-2026-45171

Idira Privileged Session Manager (PSM): Potential Code Execution due to an Incomplete Input Validation_CVE-2026-45171

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14...

CyberArk Software, a Palo Alto Networks Company Privileged Session Manager, Vault 14.0 CVE
CRITICAL 9.8 CVE-2026-45060

ClipBucket: Blind SQL Injection in progress_video.php_CVE-2026-45060

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to bli...

MacWarrior clipbucket-v5 < 5.5.3 - #129 CVE
CRITICAL 9.8 CVE-2026-42846

ClipBucket: Remote Play URL Command Injection_CVE-2026-42846

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated us...

MacWarrior clipbucket-v5 < 5.5.3 - #140 CVE
CRITICAL 9.1 CVE-2026-50638

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections_CVE-2026-50638

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions suc...

PEVANS Metrics::Any::Adapter::DogStatsd CVE
CRITICAL 9.2 CVE-2026-49973

Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings_CVE-2026-49973

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initi...

nesquena hermes-webui CVE
CRITICAL 9 CVE-2026-41005

UAA accepts SAML Encrypted Assertions authentication bypass_CVE-2026-41005

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity...

Cloud Foundry UAA 2.0.0 CVE