10774 matches found
CVE-2026-15023
The Events Manager WordPress plugin (versions up to and including 7.4.0 ) is vulnerable to a second-order SQL injection via the stored meta_key field in the Event/Location Duplicate action. An attacker with contributor-level or higher access plants SQL metacharacters into a custom meta key throug...
CVE-2026-15023 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...
EUVD-2026-65172
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
PT-2026-81391
Name of the Vulnerable Software and Affected Versions Nextcloud MCP Server versions prior to 0.117.2 Description The POST /webhooks/nextcloud endpoint lacks authentication by default because the WEBHOOK SECRET variable defaults to None and is not required during startup validation. When this secr...
CVE-2026-14280: Improper Control of Filename for Include/Require Statement in PHP Program
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
CVE-2026-17089: Improper Neutralization of Input During Web Page Generation
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-77128: Missing Authorization
The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...
CVE-2026-53965: Uncontrolled Resource Consumption
The MCP PHP SDK Composer package mcp/sdk is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only...
CVE-2026-15023: Improper Neutralization of Special Elements used in an SQL Command
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'metakey' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...
PT-2026-81122
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficient escaping on the user supplied parameter and lack of...
PT-2026-81164
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em options save function. This makes it possible for authenticated attackers, with administrator-level access and above, to...
The vulnerability of the perf_mmap_rb() function in the kernel/events/core.c module, which manages kernel events in Linux operating systems, allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the perfmmaprb function in the kernel/events/core.c module, which handles kernel event management in Linux operating systems, is related to the reuse of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...
PT-2026-81165
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-81161
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-10627: Missing Authorization
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
The vulnerability of the `merge_sched_in()` function in the kernel/events/core.c module, which manages kernel events in Linux operating systems, allows a hacker to cause a service failure.
The vulnerability of the mergeschedin function in the kernel/events/core.c module, which manages kernel events in Linux operating systems, is related to the use of an unprotected alternative channel. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2026-78265
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
CVE-2026-78265 WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in The Events Calendar = 6.17.2 versions...
