CVE-2025-69358 WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through = 4.2.6.0...

CVE-2025-69358 WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through = 4.2.6.0...

PT-2026-27857

Name of the Vulnerable Software and Affected Versions Metagauss EventPrime versions through 4.2.8.0 Description The software contains a flaw due to deserialization of untrusted data, which allows for object injection. This issue impacts the eventprime-event-calendar-management component...

WordPress plugin Booking calendar, Appointment Booking System 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

PT-2026-27959

Name of the Vulnerable Software and Affected Versions codepeople CP Multi View Event Calendar versions through 1.4.35 Description The software contains a flaw related to improper input handling during web page generation, leading to a cross-site scripting issue. This allows for Stored XSS attacks...

WordPress plugin CP Multi View Event Calendar 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-27946

Name of the Vulnerable Software and Affected Versions wpdevart Booking calendar, Appointment Booking System versions n/a through 3.2.36 Description The software contains a flaw related to improper handling of user-supplied data during web page creation, which could allow for cross-site scripting...

PT-2026-27808

Name of the Vulnerable Software and Affected Versions Metagauss EventPrime versions n/a through 4.2.6.0 Description A missing authorization flaw exists in Metagauss EventPrime eventprime-event-calendar-management. This issue allows exploitation of incorrectly configured access control security...

Mandiant Global Median Dwell Time Deteriorates from 11 to 14 Days

Oh snap. My single most important cybersecurity metric deteriorated again. In the M-Trends report for calendar year 2024, Mandiant’s global median dwell time metric worsened from 10 to 11 days. In the newest report, released today, for calendar year 2025, that metric worsened again, from 11 to 14...

CRLF Injection

Overview icalendar is an Implements the iCalendar specification RFC-5545 in Ruby. This allows for the generation and parsing of .ics files, which are used by a variety of calendaring applications. Affected versions of this package are vulnerable to CRLF Injection via the serialization process of...

GHSA-PV9C-9MFH-HVXQ iCalendar has ICS injection via unsanitized URI property values

Summary .ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output. Details Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with...

iCalendar has ICS injection via unsanitized URI property values

Summary .ics serialization does not properly sanitize URI property values, enabling ICS injection through attacker-controlled input, adding arbitrary calendar lines to the output. Details Icalendar::Values::Uri falls back to the raw input string when URI.parse fails and later serializes it with...

CVE-2026-33668

Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disabled or locked, the status check is only enforced on the local login and JWT token refresh paths. Three other authentication paths — API tokens, CalDAV...

CVE-2026-33315 Vikunja has a 2FA Bypass via Caldav Basic Auth

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be...

PT-2026-27632

Name of the Vulnerable Software and Affected Versions icalendar affected versions not specified Description The software does not properly sanitize URI property values during .ics serialization, leading to ICS injection. This allows attackers to inject arbitrary calendar lines through controlled...

Vikunja has a 2FA Bypass via Caldav Basic Auth

Summary The Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access standard project information that would normally be protected behind 2FA if enabled, such as project name, description, etc. Details...

EUVD-2026-13093

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

CVE-2026-3658

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

CVE-2026-3658 Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

CVE-2026-3658

CVE-2026-3658 affects the WordPress plugin chain for the Appointment Booking Calendar (Simply Schedule Appointments Booking Plugin). The Wordfence detail confirms a SQL Injection via the fields parameter in all versions up to 1.6.10.0, caused by insufficient escaping of user-supplied input and in...