256308 matches found
CVE-2026-63328
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...
CVE-2026-73383 WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability
Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...
CVE-2026-73383 WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability
Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...
CVE-2026-73383
Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...
CVE-2026-73383
The WordPress CTX Feed plugin (versions ≤ 6.6.47) allows a Shop Manager to download arbitrary files from the server. CVSS 3.1 scores it MEDIUM (4.9), requiring network access and HIGH privileges. Patchstack discovered the flaw; update to a patched version beyond 6.6.47 to remediate. No exploitati...
EUVD-2026-60798
Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...
CVE-2026-73358
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73358 WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73358 WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
EUVD-2026-60782
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73358
The Affiliates Manager WordPress plugin (≤2.9.53) is vulnerable to unauthenticated reflected/stored XSS due to insufficient input sanitization, allowing attackers to inject malicious scripts via network-accessible endpoints. CVSS 3.1 scores 7.1 (HIGH) with no privileges required. Exploitation det...
EUVD-2026-60780
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-73355
Unauthenticated SQL injection affects Affiliates Manager plugin ≤2.9.53, allowing remote attackers to extract sensitive database data (CVSS 9.3 critical). Patchstack reports the flaw; no patch version or exploit details are provided in the documents. Upgrade to the latest plugin version once avai...
CVE-2026-73355 WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-73355
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-73355 WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability
Unauthenticated SQL Injection in Affiliates Manager = 2.9.53 versions...
CVE-2026-73345 WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability
Customer SQL Injection in License Manager for WooCommerce = 3.0.18 versions...