nginx-proxy-manager Prototype Pollution via JSON Parser Enables Unauthenticated RCE (CVE-2026-13228)

Scope: nginx-proxy-manager-2-rootfs Package Versions Prior to 2.13.1-r0

Severity: Red

Read More

Custom Payment Gateways for WooCommerce Unauthenticated Stored XSS in Checkout Fields (CVE-2026-7517)

Scope: Custom Payment Gateways for WooCommerce Plugin Versions up to and Including 2.1.0

Severity: High

Read More

Download Manager WordPress Plugin Authenticated Stored XSS via Shortcode Attribute (CVE-2026-13733)

Scope: Download Manager WordPress Plugin Versions up to and Including 3.3.60

Severity: Medium

Read More

NEX-Forms WordPress Plugin Unauthenticated Stored XSS via Form Field Name (CVE-2026-12142)

Scope: NEX-Forms Ultimate Forms Plugin for WordPress Versions up to and Including 9.2.2

Severity: High

Read More

WSO2 API Manager – Server-Side Request Forgery (CVE-2026-2053)

Scope: WSO2 API Manager, Versions 3.1.0, 3.2.0, 3.2.1, 4.0.0, and 4.2.0 Prior to Fixed Product Releases

Severity: High

Read More

Flowise – Authentication Bypass via Registration Endpoint (CVE-2025-71327)

Scope: Flowise, All Versions Lacking Registration Restrictions

Severity: Critical

 

Read More