TYPE5AFE

Unsafe Deserialization on .npz dataset leads to Remote Code Execution
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
product: francescopace/espectre
ref: https://nusasec.org/advisories/cve-2026-102739

SQL Injection in Twenty CRM searchVector leads to Remote Code Execution
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
product: TwentyHQ/twenty
ref: https://nusasec.org/advisories/cve-2026-73069

RegexCheck causes Uncontrolled Resource Consumption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
product: weblate/weblate
ref: https://nusasec.org/advisories/cve-2026-62326

wlc Leaks API Token to Attacker-Controlled Weblate URL via Untrusted Project Config Discovery
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
product: weblate/wlc
ref: https://nusasec.org/advisories/cve-2026-22251

Wagtail Image Preview IDOR via Missing Object-Level Permission Check
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
product: wagtail/wagtail
ref: https://nusasec.org/advisories/cve-2026-54261

Unbounded filter specs in in wagtail image preview cause DoS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
product: wagtail/wagtail
ref: https://nusasec.org/advisories/cve-2026-54260

Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
product: smub/easy-digital-downloads
ref: https://www.wordfence.com/threat-intel/vulnerabilities/id/e375f761-459c-4cad-823b-2a94ac901410

My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
product: joedolson/my-calendar
ref: https://www.wordfence.com/threat-intel/vulnerabilities/id/3e27c0b0-c74f-47ad-b9ed-9fd6bd05d040

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
product: 10web/form-maker
ref: https://www.wordfence.com/threat-intel/vulnerabilities/id/f37cc880-d8a4-431a-9639-abf01163030a

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
product: cozmoslabs/profile-builder
ref: https://www.wordfence.com/threat-intel/vulnerabilities/id/760f7736-db49-4210-a2f3-3abb506106d7