18339 matches found
CVE-2026-18807 ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers
The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...
CVE-2026-14230
The ECS WordPress plugin (specifically Ele Custom Skin for Elementor ) versions before 4.3.8 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability or object-ownership checks on its Dynamic Repeater AJAX handlers . While these handlers are gated by a nonce, an...
CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
EUVD-2026-58857
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...
CVE-2026-18807: Missing Authorization
The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...
CVE-2026-14230: Improper Neutralization of Input During Web Page Generation
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
CVE-2026-15993: Improper Neutralization of Special Elements used in an SQL Command
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...
Linux Distros Unpatched Vulnerability : CVE-2026-72028
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r...
PT-2026-72153
Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.45 Description An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameter...
CVE-2026-12366
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
GO-2022-0969 vulnerabilities
Vulnerabilities for packages: grpcurl, dynamic-localpv-provisioner, wireguard-go, kubeflow-fips, k3d, terraform-provider-sendgrid-fips, kubeflow, kube-state-metrics, terraform-provider-sendgrid, dynamic-localpv-provisioner-fips, kubeflow-katib, hey...
GO-2022-0322 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips...
GO-2021-0356 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner, kubeflow-fips, k3d, terraform-provider-sendgrid-fips, kubeflow, terraform-provider-sendgrid, dynamic-localpv-provisioner-fips...
GO-2022-0603 vulnerabilities
Vulnerabilities for packages: thanos-operator, dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips, thanos-operator-fips...
GO-2022-0411 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner, dynamic-localpv-provisioner-fips...
GO-2021-0113 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner, gitleaks, k3d, terraform-provider-sendgrid-fips, vt-cli, terraform-provider-sendgrid, dynamic-localpv-provisioner-fips, hey...
GO-2022-0968 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner, kubeflow-fips, k3d, terraform-provider-sendgrid-fips, kubeflow, terraform-provider-sendgrid, dynamic-localpv-provisioner-fips...
