keyboard_arrow_up

CVEs

Vulnerabilities I reported, with public advisories, affected versions and fixes. Related research is linked where available.

5 CVEs · Latest advisories first · Undated first Updated October 5, 2026

CVE-2026-102173

Severity pending
Details pending Publication date pending

Public details not yet verified

CVE.org
Details

No public CVE record or advisory could be verified as of October 5, 2026. Product, impact, severity and affected versions will be added when a public advisory is available.

CVE-2026-96837

CVSS 8.8 · High
CartFlows · WordPress

Contributor remote code execution

↓ 11,049,982 WordPress downloads Including updates ·
Affected
Through 3.2.0
Fixed in
3.2.1
CVE.org Patchstack advisory
Details

A user with Contributor-level privileges could execute arbitrary code on the server through the CartFlows plugin.

CVE-2026-94504

CVSS 7.2 · High
Ninja Forms · WordPress

Unauthenticated stored cross-site scripting

↓ 63,819,545 WordPress downloads Including updates ·
Affected
Through 3.15.3
Fixed in
3.15.4
CVE.org Wordfence advisory
Details

Insufficient input sanitization and output escaping could allow unauthenticated users to store scripts that execute when an affected page is viewed.

CVE-2026-81180

CVSS 8.8 · High
SysReptor Professional

Authenticated remote code execution

Affected
Through 2026.55 (vendor advisory)
Fixed in
2026.61 (2026.58 provides a partial mitigation)
CVE.org SysReptor advisory Research ↗
Details

Insecure image processing could allow authenticated users to execute code with the privileges of the application process. The Community edition is not affected.

CVE-2026-81179

CVSS 8.1 · High
SysReptor

Host header injection / account takeover

Affected
Through 2026.55 (vendor advisory)
Fixed in
2026.58
CVE.org SysReptor advisory Research ↗
Details

Password-reset links could use an untrusted host, potentially allowing account takeover when a victim follows the link. Exposure depends on the deployment configuration and password reset being enabled.