290779 matches found
CVE-2026-9812
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...
CVE-2026-78375
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilderarticleid from the request and concatenated it directly into the WHERE viewid ...
CVE-2026-13417
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of fields.properties on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child...
CVE-2026-10556
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...
CVE-2026-78375 Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilderarticleid from the request and concatenated it directly into the WHERE viewid ...
CVE-2026-78375
SP Page Builder (Free and Pro) by joomshaper.com, a Joomla extension, is affected by an authenticated privileged SQL injection in versions 5.2.1 through 6.9.0 . The vulnerable function plgContentSppagebuilder::onContentAfterSave() reads jform[attribs][sppagebuilder_article_id] from the request an...
CVE-2026-78375 Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder Free and Pro 5.2.1 - 6.9.0 - plgContentSppagebuilder::onContentAfterSave read jformattribssppagebuilderarticleid from the request and concatenated it directly into the WHERE viewid ...
EUVD-2026-77379
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...
CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...
CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of fields.properties on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child...
CVE-2026-13417 Boards plugin denial of service via unvalidated block fields.properties
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate the type of fields.properties on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child...
CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...
EUVD-2026-77374
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...
CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST...
WordPress Booking for Appointments and Events Calendar plugin < 2.4.10 - Amelia Manager+ WordPress Account Takeover vulnerability
Amelia Manager+ WordPress Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Amelia versions 2.4.10...
WordPress Export & Import WPBakery Page Builder plugin <= 1.0.2 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin Export & Import WPBakery Page Builder versions = 1.0.2...
WordPress Booking for Appointments and Events Calendar plugin 9.0-9.8.0 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Amelia versions 9.0-9.8.0...
WordPress Temporary Login Without Password plugin < 1.9.9 - Authenticated Temporary Access Revocation Bypass vulnerability
Authenticated Temporary Access Revocation Bypass vulnerability discovered by BaptouTatis in WordPress Plugin Temporary Login Without Password versions 1.9.9...
WordPress YayPricing plugin < 3.5.7 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin YayPricing versions 3.5.7...
WordPress GenieWords plugin 1.5.27-1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite vulnerability
Unauthenticated Stored XSS and Configuration Overwrite vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin GenieWords versions 1.5.27-1.5.34...