9084 matches found
CVE-2026-54826 WordPress SupportCandy plugin <= 3.4.6 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in SupportCandy = 3.4.6 versions...
EUVD-2026-39625
The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as...
PT-2026-52728
Name of the Vulnerable Software and Affected Versions SupportCandy versions prior to 3.4.7 Description An Insecure Direct Object Reference IDOR exists, which occurs when an application provides direct access to objects based on user-supplied input, potentially allowing unauthorized access to data...
GO-2026-5770 Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber in github.com/ellanetworks/core
Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber in github.com/ellanetworks/core...
GO-2026-5722 free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication in github.com/free5gc/udr
free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication in github.com/free5gc/udr...
GO-2026-5189 Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI in github.com/free5gc/pcf
Free5GC PCF: Missing authentication middleware in NpcfSMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI in github.com/free5gc/pcf...
CVE-2026-56053
Subscriber PHP Object Injection in EventPrime = 4.3.4.1 versions...
CVE-2026-54838
Subscriber SQL Injection in WC Vendors Marketplace = 2.6.8 versions...
CVE-2026-54821
Subscriber Sensitive Data Exposure in Visual Link Preview = 2.3.1 versions...
CVE-2026-54822
Subscriber SQL Injection in SALESmanago & Leadoo = 3.11.2 versions...
CVE-2026-56054 WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in JS Help Desk = 3.1.1 versions...
CVE-2026-56054
Subscriber Arbitrary File Deletion in JS Help Desk = 3.1.1 versions...
EUVD-2026-39383
Subscriber Arbitrary File Deletion in JS Help Desk = 3.1.1 versions...
CVE-2026-56053
CVE-2026-56053 concerns the WordPress plugin EventPrime (versions
CVE-2026-56053
Subscriber PHP Object Injection in EventPrime = 4.3.4.1 versions...
CVE-2026-56053 WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in EventPrime = 4.3.4.1 versions...
EUVD-2026-39382
Subscriber PHP Object Injection in EventPrime = 4.3.4.1 versions...
CVE-2026-56005
Subscriber Cross Site Scripting XSS in WP Activity Log = 5.6.3.1 versions...