17785 matches found
PT-2026-39509
Name of the Vulnerable Software and Affected Versions WordPress MStore API version 2.0.6 Description An arbitrary file upload flaw allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. By uploading PHP files with arbitrary names to the confi...
CVE-2021-47933: Missing Authentication for Critical Function
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Attackers can upload PHP files with arbitrary names to the configfile endpoint to achieve remote code...
CVE-2026-8198 Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API
The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an...
CVE-2026-42137
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, pages.access/list and files.access/list permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0...
CVE-2026-42137 Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, pages.access/list and files.access/list permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0...
CVE-2026-42137
Kirby CVE-2026-42137 affects the open-source Kirby CMS. Prior to versions 4.9.0 and 5.4.0, the Panel and REST API did not consistently enforce pages.access/list and files.access/list permissions, enabling missing authorization in some collections and related models. The issue has been fixed in Ki...
CVE-2026-8115
A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in path traversal. The attack can be launched remotely. The...
CVE-2026-8198: Exposure of Sensitive Information to an Unauthorized Actor
The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to Authentication Bypass to Information Disclosure in versions up to, and including, 3.3.6. This is due to a logic flaw in the verifyAuthorization method where requests without an...
CVE-2026-42137: Missing Authorization
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, pages.access/list and files.access/list permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0...
com.oviva.telematik:epa4all-rest-service (0.0.5) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (0.0.5)
com.oviva.telematik:epa4all-client MAVEN version 0.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.5 Source cves: CVE-2026-44900 Source advisory:...
com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.0), com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.0) +2 more potentially affected by CVE-2026-44900 via com.oviva.telematik:vau-httpclient (>=1.0.0, <=1.2.0)
com.oviva.telematik:vau-httpclient MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2026-44900 Source advisory: SNYK:JAVA-COMOVIVATELEMATIK-17157661...
com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.0) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.0)
com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2026-44900 Source advisory: OSV:GHSA-G8R3-5HWF-QP96...
com.oviva.telematik:epa4all-rest-service (0.0.4) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (0.0.4)
com.oviva.telematik:epa4all-client MAVEN version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.4 Source cves: CVE-2026-44900 Source advisory:...
com.oviva.telematik:epa4all-rest-service (>=1.0.0, <=1.2.0) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (>=1.0.0, <=1.2.0)
com.oviva.telematik:epa4all-client MAVEN version =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2026-44900 Source advisory: GHSA-G8R3-5HWF-QP96...
com.oviva.telematik:epa4all-rest-service (0.0.8) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (0.0.8)
com.oviva.telematik:epa4all-client MAVEN version 0.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.8 Source cves: CVE-2026-44900 Source advisory:...
com.oviva.telematik:epa4all-rest-service (0.0.7) potentially affected by CVE-2026-44900 via com.oviva.telematik:epa4all-client (0.0.7)
com.oviva.telematik:epa4all-client MAVEN version 0.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.oviva.telematik:epa4all-client and may be impacted: - com.oviva.telematik:epa4all-rest-service 0.0.7 Source cves: CVE-2026-44900 Source advisory:...
EUVD-2026-28543
The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sky-custom-scripts custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with capabilitytype = 'post' and showinrest = true, combined with...
CVE-2026-7475
The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sky-custom-scripts custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with capabilitytype = 'post' and showinrest = true, combined with...
CVE-2026-7475
The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sky-custom-scripts custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with capabilitytype = 'post' and showinrest = true, combined with...
CVE-2026-42150
wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0...