2026

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via develop

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activi

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configur

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tool

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configur

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-loca

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-loca

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default

Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.

Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.

Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.

Unauthenticated SQL Injection in Bookly <= 27.7 versions.

Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Pro

Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.

Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.

Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.

Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.

Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.

Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.

Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.

Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.

Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.

Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.