8869 matches found
WordPress < 4.8.2 - Authenticated Open Redirect
WordPress versions before 4.8.2 contain an open redirect caused by improper validation in wp-admin/edit-tag-form.php and wp-admin/user-edit.php, letting attackers redirect users to malicious sites, exploit requires access to admin interface. id: CVE-2017-14725 info: name: WordPress 4.8.2 -...
Xinuo Openserver 5/6 - Cross-Site scripting
Xinuo formerly SCO Openserver versions 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section' and is vulnerable to reflected cross-site scripting. id: CVE-2020-25495 info: name: Xinuo Openserver 5/6 - Cross-Site scripting author: 0xAkoko severity:...
CVE-2026-15421
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-62219
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-62585
creationtimestamp| type| source ---|---|--- 2026-08-18 22:16:06+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfakxt6d62p 2026-08-19 03:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtfsodtig22j...
@rhinostone/swig: arbitrary local file read via include/extends path traversal
Overview @rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The % include %, % extends %, and % import % tags resolve their target path through the filesystem...
CVE-2026-66633
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
CVE-2026-71979 INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing
INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...
MINI-QMC6-WH95-RMQ7
Bulletin has no description...
BIT-DISCOURSE-2026-72732 Discourse: Templates endpoint exposes hidden tag names
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb d...
BIT-DISCOURSE-2026-72723 Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An...
CVE-2026-19959
creationtimestamp| type| source ---|---|--- 2026-08-16 23:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtad7lvri325 2026-08-17 00:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtafj27yjp2z 2026-08-17 01:06:11+00:00| seen|...
MINI-W795-PFJ3-7R9Q
Bulletin has no description...
MINI-W7HH-FRFM-8QQ3
Bulletin has no description...
MINI-V865-QRWW-8X5G
Bulletin has no description...
CVE-2026-72131
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...
UBUNTU-CVE-2026-72086
In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsibackdeviceaction obtains a command tag in scsibackgetpendreq and submits a task-management request with targetsubmittmr. When targetsubmittmr fails it...
CVE-2026-72286 KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper migration requires additional SNP-specific state such as...
CVE-2026-72131 nvme-apple: Prevent shared tags across queues on Apple A11
In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...