8124 matches found
CVE-2026-0673 Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...
WordPress Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons plugin <= 8.3.15 - Unauthenticated SMTP Header Injection vulnerability
Unauthenticated SMTP Header Injection vulnerability discovered by Drew Webber mcdruid in WordPress Plugin Element Pack Elementor Addons versions = 8.3.15...
PT-2026-70203
Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An incorrect authorization issue exists where a control-panel user with only the viewCategories permission, but lacking the saveCategories permission, can permanently modify a category...
PT-2026-68622
Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Open Redirect issue exists in the HTML5 scrubber where an unauthenticated remote attacker can retarget an existing form on a rendering page to capture submitted data, including...
PT-2026-68624
Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Inclusion of Functionality from Untrusted Control Sphere issue exists in the HTML5 scrubber. A remote attacker can load an arbitrary document into a trusted page by utilizing the dat...
PT-2026-68623
Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Open Redirect issue exists in the HTML5 scrubber of the software. A remote attacker can force visitors to navigate to an untrusted site by inserting a element into sanitized HTML. Th...
WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element
Description WordPress does not properly restrict the content of submitted posts in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against users previewing the post...
PT-2026-75910
Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...
PT-2026-76017
A control-panel user who holds only the viewCategories permission for a category group and not saveCategories can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action. A read-time authorization grant that a write endpoi...
PT-2026-75997
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has edit users permission which doesn’t allow changing...
PT-2026-68479
Name of the Vulnerable Software and Affected Versions Element Pack Addons for Elementor versions prior to 8.3.16 Description An Email Header Injection issue exists due to insufficient sanitization of newline characters in user-supplied input that is concatenated into email headers. This allows...
CVE-2026-66829: URL Redirection to Untrusted Site
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...
CVE-2026-65502: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
CVE-2026-0673: Improper Neutralization of CRLF Sequences
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...
DEBIAN-CVE-2026-19023
Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...
GHSA-48HR-524C-V5W3 Nuxt: Unauthorized Component Instantiation via Server Island Props
Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...
Nuxt: Unauthorized Component Instantiation via Server Island Props
Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...
Exploit for NULL Pointer Dereference in Linux Linux_Kernel
--- CVE-2026-23002 – 5G NAS Message Buffer Overflow in gNode...
CVE-2026-64578 ksmbd: validate compound request size before reading StructureSize2
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...
