CVE-2026-48192

A vulnerability has been identified in Mendix Studio Pro 10.11 All versions, Mendix Studio Pro 10.12 All versions, Mendix Studio Pro 10.13 All versions, Mendix Studio Pro 10.14 All versions, Mendix Studio Pro 10.15 All versions, Mendix Studio Pro 10.16 All versions, Mendix Studio Pro 10.17 All...

CVE-2026-48192

CVE-2026-48192 affects Mendix Studio Pro across multiple versions (10.x and 11.x) with a flaw where built project files are not properly validated/sanitized during the build pipeline. An attacker could trick a user into opening and running a specially crafted malicious project locally, potentiall...

EUVD-2026-40330

A vulnerability has been identified in Mendix Studio Pro 10.11 All versions, Mendix Studio Pro 10.12 All versions, Mendix Studio Pro 10.13 All versions, Mendix Studio Pro 10.14 All versions, Mendix Studio Pro 10.15 All versions, Mendix Studio Pro 10.16 All versions, Mendix Studio Pro 10.17 All...

CVE-2026-48192

A vulnerability has been identified in Mendix Studio Pro 10.11 All versions, Mendix Studio Pro 10.12 All versions, Mendix Studio Pro 10.13 All versions, Mendix Studio Pro 10.14 All versions, Mendix Studio Pro 10.15 All versions, Mendix Studio Pro 10.16 All versions, Mendix Studio Pro 10.17 All...

WordPress EventON (Pro) - WordPress Virtual Event Calendar Plugin plugin <= 5.0.11 - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection vulnerability

WordPress EventON Pro - WordPress Virtual Event Calendar Plugin plugin = 5.0.11 - WordPress Virtual Event Calendar Plugin = 5.0.11 - Unauthenticated Blind SQL Injection vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin EventON versions = 5.0.11...

PT-2026-53897

Name of the Vulnerable Software and Affected Versions Mendix Studio Pro versions 10.11 through 10.23 Mendix Studio Pro versions prior to 10.24.21 Mendix Studio Pro versions 11.0 through 11.5 Mendix Studio Pro versions prior to 11.6.7 Mendix Studio Pro versions 11.7 through 11.11 Description...

CVE-2026-48192: Improper Control of Generation of Code

A vulnerability has been identified in Mendix Studio Pro 10.11 All versions, Mendix Studio Pro 10.12 All versions, Mendix Studio Pro 10.13 All versions, Mendix Studio Pro 10.14 All versions, Mendix Studio Pro 10.15 All versions, Mendix Studio Pro 10.16 All versions, Mendix Studio Pro 10.17 All...

Siemens Mendix Studio Pro

SUMMARY Mendix Studio Pro versions before V11.12 are affected by a file parsing vulnerability that could be triggered when the application reads specially crafted malicious project during the build pipeline. This could allow an attacker to execute arbitrary code in the context of that user...

CVE-2026-57949

ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this ...

CVE-2026-57950 ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController

ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement...

CVE-2026-57949

ruoyi-vue-pro (through 2026.05) contains a missing authorization vulnerability in the CRM module’s GET /admin-api/crm/follow-up-record/get endpoint. The issue allows an authenticated user to read any follow-up record by iterating sequential numeric IDs, exfiltrating follow-up notes, file attachme...

CVE-2026-57949 ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint

ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this ...

CVE-2026-57329

Subscriber Cross Site Scripting XSS in WooCommerce Designer Pro = 1.9.34 versions...

WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Admin and Site Enhancements ASE Pro versions = 8.8.5...

CVE-2026-57329 WordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WooCommerce Designer Pro = 1.9.34 versions...

CVE-2026-57329 WordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WooCommerce Designer Pro = 1.9.34 versions...

CVE-2026-57329

Subscriber Cross Site Scripting XSS in WooCommerce Designer Pro = 1.9.34 versions...

EUVD-2026-40100

Subscriber Cross Site Scripting XSS in WooCommerce Designer Pro = 1.9.34 versions...

CVE-2026-57329

CVE-2026-57329 describes a Subscriber Cross Site Scripting (XSS) vulnerability in the WooCommerce Designer Pro plugin up to version 1.9.34. CVSS v3.1 base score 6.5 (attackVector: NETWORK, attackComplexity: LOW, privilegesRequired: LOW, userInteraction: REQUIRED, scope: CHANGED, confidentiality/i...

WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Blocksy Companion Pro versions = 2.1.46...