91531 matches found
CVE-2026-65520: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-66696: Insertion of Sensitive Information Into Sent Data
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...
CVE-2026-66707: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
CVE-2026-66708: Missing Authorization
Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...
CVE-2026-66686: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...
CVE-2026-61982: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...
CVE-2026-65502: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
CVE-2024-6832: Protection Mechanism Failure
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...
CVE-2026-66663: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-65577: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...
CVE-2026-5430: Improper Verification of Cryptographic Signature
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...
CVE-2026-61959: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...
@whalent/agent (0.3.255) potentially affected by unknown CVE via @whalent/agent-core (0.3.255)
@whalent/agent-core NPM version 0.3.255 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.255 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...
openvas-scanner v23.50.14
OpenVAS Scanner This is the OpenVAS Scanner of the Greenbone Community Edition. It is used for the Greenbone Enterprise appliances and is a full-featured scan engine that executes a continuously updated and extended feed of Vulnerability Tests VTs. Releases All release files are signed with the...
@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70609 via electron (>=39.0.0, <=39.2.7)
electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....
@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70604 via electron (>=40.0.0, <=40.8.5)
electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =40.1.0, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70604 Source advisory: OSV:GHSA-V3J7-R9GQ-3GJW...
MAL-2026-12825 Malicious code in beaver-ui-split-view (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...
Malicious code in cobrowsing-cobrowsing-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9 [email protected] is a binary dropper disguised as a platform core package. On require/import index.js loads polyfill.js, the package...
SkillSpector v2.5.3
SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...
