← All credits
Jakub Herman
67 vulnerability records and advisories credit this contributor.
CVE-2026-19094
Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters
CVE-2026-19220
Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation
CVE-2026-19718
BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery
CVE-2026-18052
ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters
CVE-2026-19221
Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite
CVE-2026-18781
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
CVE-2026-19848
ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name
CVE-2026-18051
W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key
CVE-2026-18937
Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
CVE-2026-14287
TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass