41293 matches found
EUVD-2026-37407
Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft component: Performance Monitor. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
EUVD-2026-37732
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...
CVE-2026-49502
Dell PowerFlex Manager, versions prior to 5.1.0.1, contains an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Unauthorized access...
CVE-2026-54810 WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexi XPay: from n/a through 8.3.1...
CVE-2026-54816
Improper Control of Generation of Code 'Code Injection' vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through 2.0.21...
CVE-2026-54809
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10...
CVE-2026-40733
Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...
CVE-2026-39556
Unauthenticated PHP Object Injection in Konsept = 1.9 versions...
CVE-2025-69170
Unauthenticated Local File Inclusion in Eventicity = 1.5 versions...
CVE-2025-69174
Unauthenticated Local File Inclusion in Etude = 1.6 versions...
CVE-2025-69166
Unauthenticated Local File Inclusion in Gunslinger = 1.7 versions...
CVE-2025-69157
Unauthenticated Local File Inclusion in Gamic = 1.15 versions...
CVE-2025-69164
Unauthenticated Local File Inclusion in Skyward = 1.10 versions...
CVE-2025-69127
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
CVE-2025-69120
Unauthenticated Local File Inclusion in Dazzle = 1.0.0 versions...
CVE-2025-66391
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-controlled email address when the attacker attempts to reset the password of a user account...
CVE-2026-54196
Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1...
CVE-2026-48869
Unauthenticated Cross Site Scripting XSS in Enfold = 7.1.4 versions...