5577 matches found
CVE-2026-66709
The CVE-2026-66709 entry describes a Remote Code Execution (RCE) vulnerability in the WordPress CTX Feed plugin (CTX Feed)
CVE-2026-66709 WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...
EUVD-2026-53985
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
CVE-2026-65560
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
CVE-2026-65560
The vulnerability CVE-2026-65560 is an Unauthenticated XSS in the WordPress Houzez Property Feed plugin, affected versions
CVE-2026-65560 WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
CVE-2026-65560 WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
CVE-2026-64584
creationtimestamp| type| source ---|---|--- 2026-08-06 12:15:14+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-64584 2026-08-12 20:46:06+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...
WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Houzez Property Feed versions = 2.5.48...
CVE-2026-65560: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
CVE-2026-66709: Improper Control of Generation of Code
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
Summary A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent...
CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
CVE-2026-71311
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
EUVD-2026-53618
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
CVE-2026-71311
rclone (pre-1.75.0) is affected by a CRLF injection in FTP filename handling: a valid but nondefault encoding in backend/ftp/ftp.go can restore raw CR/LF before an attacker-controlled path is interpolated into the FTP control channel. github.com/jlaffaye/ftp formats the argument via textproto.Con...
CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...
WordPress Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin <= 6.11.3 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Instagram Feed versions = 6.11.3...
CVE-2026-15452 Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...