5100 matches found
EUVD-2026-59801
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...
CVE-2026-73052 SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...
CVE-2026-73052 SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...
CVE-2026-73052
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...
Vim: Arbitrary Code Execution via Netrw Menu Construction
...
CVE-2026-73052: Improper Neutralization of Input During Web Page Generation
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...
PT-2026-73056
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored Cross-Site Scripting XSS occurs because attribute-view field names are stored without HTML escaping and interpolated directly into option elements using innerHTML within the sort menu. An...
admin-menu-groups
Admin Menu Groups Create collapsible groups in the WordPress...
WordPress TLP Food Menu plugin < 6.0.2 - Unauthenticated Reservation Status Modification vulnerability
Unauthenticated Reservation Status Modification vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions 6.0.2...
CVE-2026-13328
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...
CVE-2026-13328
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...
CVE-2026-13328
The Food Menu WordPress plugin (versions before 6.0.2 ) is vulnerable to an unauthenticated reservation status modification flaw. The plugin fails to perform necessary capability or ownership checks on its reservation-status update action. Because this action is exposed to unauthenticated users a...
EUVD-2026-57724
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...
CVE-2026-13328 TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...
CVE-2026-13328: Improper Access Control
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...
PT-2026-71389
Name of the Vulnerable Software and Affected Versions Food Menu versions prior to 6.0.2 Description An issue exists where the plugin fails to perform capability or ownership checks on the reservation-status update action. This action is exposed to unauthenticated users and is protected only by a...
Linux Distros Unpatched Vulnerability : CVE-2026-73078
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vi...
CVE-2026-73250
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory $INSTDIR from PowerEditor/installer/nppSetup.nsi into a PowerShell -Command string used by RegisterMSIX to invoke...
AZL-95550 CVE-2026-73078 affecting package vim for versions less than 9.2.0957-1
Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...
CVE-2026-73078
Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...