Daniel Miranda YAMCS yamcs-core 5.12.7 - LDAP Injection
webapps multiple CVE-2026-42568

cardosource MikroORM 7.0.13 - SQL Injection
webapps multiple CVE-2026-44680

Diamorphine Prodigy Commerce 3.3.0 - Local File Inclusion
webapps multiple CVE-2026-0926

Diamorphine Langflow 1.3.0 - Remote Code Execution
webapps multiple CVE-2026-0770

cardosource Quick Playground for WordPress 1.3.1 - Unauthenticated Remote Code Execution
webapps multiple CVE-2026-1830

cardosource MixPHP Framework 2.2.17 - Unsafe Deserialization Remote Code Execution
webapps php CVE-2026-42471

Th3-SAx11 CubeCart < 6.7.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
webapps multiple CVE-2026-44376

sixpain Casdoor 3.54.1 - Arbitrary File Write via Path Traversal
webapps go CVE-2026-6815

Max Gabriel EspoCRM 9.3.3 - SSRF
webapps multiple CVE-2026-33534

joshua scramble - Remote Code Execution
webapps php CVE-2026-44262

Gabriel Rodrigues OpenCATS 0.9.7.4 - SQL Injection
webapps multiple

Mustafa Murat Akgül Grav CMS 2.0.0-beta.2 - Remote Code Execution
webapps php CVE-2026-42607

alisunbul Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service
webapps multiple CVE-2026-23918

Amir Hossein Jamshidi Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover
webapps multiple CVE-2026-7567

nu11secur1ty cPanel - CRLF Injection
webapps php CVE-2026-41940

Abdelazim Mohammed Cockpit 359 - RCE
webapps multiple CVE-2026-4631