12743 matches found
CVE-2026-15827 GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are...
CVE-2026-15827
The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are...
CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...
PT-2026-63847
Subscriber Broken Access Control in WP ERP = 1.17.5 versions...
PT-2026-63828
Unauthenticated Cross Site Scripting XSS in Sprout Clients = 3.2.3 versions...
PT-2026-63939
Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...
PT-2026-63805
Contributor SQL Injection in eRoom = 1.7.1 versions...
PT-2026-63825
Unauthenticated Cross Site Scripting XSS in Coaching = 3.9.2 versions...
PT-2026-63945
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
PT-2026-63944
Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...
PT-2026-63858
Unauthenticated Broken Authentication in Ziina = 1.2.21 versions...
PT-2026-63830
Subscriber Cross Site Scripting XSS in Slider Pro = 4.8.13 versions...
PT-2026-64215
Name of the Vulnerable Software and Affected Versions React Router versions 6.0.0 through 7.17.0 Description An open redirect issue exists where the use of backslashes in the component and the useNavigate function can lead to unexpected external navigations when attacker-supplied paths are...
PT-2026-63868
Unauthenticated Broken Access Control in PayU India = 3.8.9 versions...
PT-2026-63833
Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...
PT-2026-63937
Name of the Vulnerable Software and Affected Versions Visualizer versions prior to 4.0.7 Description Themeisle Visualizer contains an issue involving improper neutralization of special elements used in an SQL command, which allows for Blind SQL Injection. This occurs specifically through the...
PT-2026-63866
Unauthenticated SQL Injection in TrueBooker = 1.2.3 versions...
PT-2026-63940
Unauthenticated Broken Access Control in Graphina = 3.1.12 versions...