Published threat advisories for July 21, 2026

An unauthenticated stored cross-site scripting vulnerability in the Ninja Forms plugin for WordPress allows attackers to inject malicious scripts via form submissions. These scripts can execute in an administrator's browser when viewing submissions, potentially leading to session theft or unauthorized site modification

NVD modified: NVD date unavailable

Grav CMS has a remote code execution vulnerability in Blueprint::dynamicData() that could allow an authenticated user to plant a malicious directive in a page. Accessing that page, even by unauthenticated visitors, would execute the command as the web server user, potentially impacting the integrity and availability of

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in Turkmesh Turkhotspot 5651 Loglama, allowing unauthenticated attackers to manipulate database commands over the network. This could lead to unauthorized access, modification, or disclosure of sensitive information. Confirmation of product usage within the environment is n

NVD modified: NVD date unavailable

A deserialization vulnerability in Apache Fory allows bypassing Java lambda deserialization checks, potentially impacting lambda capture classes. This could lead to unauthorized actions if the vulnerable component processes untrusted data. Assess its relevance in your environment.

NVD modified: NVD date unavailable

A vulnerability in Apache Fory's opt-in zero-copy deserialization feature could allow an out-of-bounds read. This could potentially lead to information disclosure or denial of service if the specific feature is enabled and reachable.

NVD modified: NVD date unavailable

A heap type confusion vulnerability exists in the C++ implementation of Apache Fory, a data serialization library. This flaw allows for out-of-bounds memory access when processing inconsistent data schemas during deserialization. It may impact the confidentiality, integrity, and availability of systems using this speci

NVD modified: NVD date unavailable

The Easy Form Builder WordPress plugin has a critical vulnerability allowing unauthenticated users to escalate privileges to administrator. This is possible by exploiting the password recovery flow to reset any user's password and gain full administrative control of the WordPress site.

NVD modified: NVD date unavailable