1864 matches found
CVE-2026-81737 FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information
The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...
CLEANSTART-2026-SL17084 Security fixes in step-ca 0.27.5-r0
Package step-ca version 0.27.5-r0 fixes 14 vulnerabilities: CVE-2026-33186, CVE-2025-27144, CVE-2026-34986, CVE-2025-22868, CVE-2026-25793...
CVE-2026-82744
Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...
EEF-CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises
Summary Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...
CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises
Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...
CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises
Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...
CVE-2026-82744
ash-project ash (Elixir library) contains a Failing Open vulnerability in Ash.Reactor.ChangeStep (lib/ash/reactor/steps/change_step.ex). When a where guard controlling a change step raises an exception (e.g., on attacker-influenced input), the rescue in apply_validation converts it to {:error, er...
Linux Distros Unpatched Vulnerability : CVE-2026-42211
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized...
CVE-2026-25250
EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."...
CVE-2026-25250
CVE-2026-25250 is a Windows Secure Boot security feature bypass caused by a missing cryptographic step in a Microsoft-signed third-party bootloader (EAZ EazyFix 12.9 ), which completely skips signature verification when loading drivers. An authorized local attacker with high privileges can bypass...
CVE-2026-25250
EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."...
CVE-2026-78333
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...
CVE-2026-78333 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...
EUVD-2026-66885
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...
CVE-2026-78333
The 12 Step Meeting List WordPress plugin (versions 3.17 through 3.19.16 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. An unauthenticated user can inject a malicious payload via the Geocode Event Log , which is stored unsanitised in the plugin's activity log and later rendered in ...
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android
Meta on Tuesday announced a set of WhatsApp account security features, including support for multiple passkeys to a single account to help users with both iOS and Android devices sign into their accounts using the phishing-resistant method. The tech giant said more than 1 billion people use a...
12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
Description The plugin does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin. The PoC...
CVE-2026-66584
Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...
CVE-2026-66584
An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the WordPress plugin 12 Step Meeting List in versions 3.19.16 and earlier , as reported by researcher V1T via PatchStack. The CVSS 3.1 base score is 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a ne...