5070 matches found
WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
Privilege escalation vulnerability exists in the Frontend Login and Registration Blocks plugin for WordPress versions = 1.0.7. An unauthenticated attacker can exploit the AJAX endpoint flrblocksusersettingshandleajaxcallback to change the administrator's email address. Subsequently, the attacker...
WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be...
Combo Blocks < 2.2.76 - Improper Access Control
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not prevent password protected posts from being displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts id:...
Post Grid <= 2.2.50 - Information Exposure via REST API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50. id: CVE-2023-40211 info: name: Post Grid = 2.2.50 - Information Exposure via REST API...
Essential Blocks < 4.4.3 - Local File Inclusion
Wordpress Essential Blocks plugin prior to 4.4.3 was discovered to be vulnerable to a significant Local File Inclusion vulnerability that may be exploited by any attacker, regardless of whether they have an account on the site. id: CVE-2023-6623 info: name: Essential Blocks 4.4.3 - Local File...
EUVD-2026-46114
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-55833
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...
CVE-2026-12900
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-12900
CVE-2026-12900 affects the WordPress plugin set Spectra Gutenberg Blocks (Website Builder for the Block Editor). The vulnerability is a Stored Cross-Site Scripting via the uagb/image block in all versions up to and including 2.19.28, caused by insufficient input sanitization and output escaping. ...
CVE-2026-12900 Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-12900
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Spectra versions = 2.19.28...
PT-2026-61728
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...
SUSE CVE-2026-63819
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on f2fsgetnodefoliora kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 1 SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller 0 PREEMPTfull Hardware name: QEMU...
CVE-2026-64180
In the Linux kernel, the following vulnerability has been resolved: mm/memoryhotplug: fix memory block reference leak on remove Patch series "mm: Fix memory block leaks and locking", v2. This series fixes two memory block device reference leaks and one locking issue around the per-memoryblock...
CVE-2026-64180
The CVE-2026-64180 entry documents a Linux kernel issue in the memory hotplug path (mm/memory_hotplug). The root cause is that remove_memory_blocks_and_altmaps() calls find_memory_block() to obtain a memory block device reference, but the acquired reference is not dropped, leading to a leaked dev...
CVE-2026-63819
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on f2fsgetnodefoliora kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 1 SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller 0 PREEMPTfull Hardware name: QEMU...
CVE-2026-16198 Sipeed PicoClaw First Run Setup access_control.go authentication bypass
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/accesscontrol.go of the component First Run Setup. Performing a manipulation of the argument allowedcidrs results in authentication bypass using alternate...
RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.6 UNC Path Injection (Windows)
The version of RabbitMQ installed on the remote Windows host is affected by a vulnerability: - On Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension...
CVE-2026-45368
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...