259288 matches found
ROS-20260914-73-0034
The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain access to confidential data through a specially created HTML page...
ROS-20260914-73-0011
The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...
CVE-2026-88802
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...
CVE-2026-89050
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...
Malicious code in janus-webdriver-manager-promise-aquarius (npm)
Source: amazon-inspector 2c1d8c34aca7485379061d221d2cf2eb91ed7e807af9137a758ed65d979477a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in iota-umbriel-webdriver-manager-ini (npm)
Source: amazon-inspector c6985abad42d26bd68fbeb023ca6e733a1830b93092f21fe9c4b8cd966ad3ac5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in impulse-rimraf-schema-webdriver-manager (npm)
Source: amazon-inspector 3f086d7a0bdd974da91e3776911c36ba418c661bbf2f3d9fb1a50f0ca0daa4c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2026-88802 MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...
CVE-2026-89050 Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...
CVE-2026-89050
The Quads Ads Manager for Google AdSense WordPress plugin, in versions before 3.0.5 , fails to verify payment completion with the configured payment gateway before marking an ad-selling order as paid. This allows authenticated users with the Subscriber+ role who can place an order to obtain a pai...
CVE-2026-88802
CVE-2026-88802 affects two WordPress plugins: MDJM Event Management (before 1.7.8.5) and Mobile Events Manager (through 1.4.8.3). The root cause is the absence of a capability check, nonce validation, or record-type verification in the plugins' playlist entry removal endpoint. An unauthenticated ...
EUVD-2026-77088
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...
EUVD-2026-77089
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...
CVE-2026-88802 MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing...
CVE-2026-89050 Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...
Cross-site Scripting (XSS)
Overview @strapi/content-manager is an A powerful UI to easily manage your data. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient sanitization of rendered rich text. An Author-role user can plant malicious tags in a rich text field, and when an Edit...
@avorati/strapi-plugin-preview (1.0.1), @catchmexz/fedin-cms (>=5.30.1, <=5.30.2) +13 more potentially affected by CVE-2026-90561 via @strapi/content-manager (>=5.0.0-beta.6, <=5.48.0)
@strapi/content-manager NPM version =5.0.0-beta.6, =5.30.1, =1.0.0, =2.0.0, =2.0.0, =5.0.0-beta.6, =3.0.0-beta.1, =0.1.0, =0.1.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2026-90561 Source advisory: SNYK:JS-STRAPICONTENTMANAGER-20158651...
CVE-2026-90561
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...
@avorati/strapi-plugin-preview (1.0.1), @catchmexz/fedin-cms (>=5.30.1, <=5.30.2) +12 more potentially affected by CVE-2026-90561 via @strapi/content-manager (>=5.0.0, <=5.48.0)
@strapi/content-manager NPM version =5.0.0, =5.30.1, =1.0.0, =2.0.0, =2.0.0, =5.0.0, =3.0.0-beta.1, =0.1.0, =0.1.4 - stronges 0.1.1 - test-lead 0.1.0 Source cves: CVE-2026-90561 Source advisory: MEND:CVE-2026-90561...
CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...