488179 matches found
CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...
EUVD-2026-51689
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...
EUVD-2026-51686
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possibl...
CVE-2026-7623 SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possibl...
[SECURITY] Fedora 44 Update: nextcloud-34.0.2-1.fc44
NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...
EUVD-2026-51656
A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...
SUSE CVE-2026-54715
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...
SUSE CVE-2026-64607
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...
PT-2026-67040
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...
PT-2026-67057
The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
PT-2026-67275
Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description Insufficient validation of server-supplied RDPDR paths during drive redirection allows a malicious RDP server to access prefix-sibling paths outside the configured shared root. By sending non-rooted...
PT-2026-67308
Name of the Vulnerable Software and Affected Versions @better-auth/sso versions prior to 1.6.21 Description Multiple authentication bypass issues exist in the handling of SSO providers, allowing attackers to sign in as arbitrary users. This can be achieved through domain verification parsing...
PT-2026-67122
Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.67 Description The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into...
PT-2026-67132
Name of the Vulnerable Software and Affected Versions Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions prior to 3.7.9 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Si...
OPENSUSE-SU-2026:11420-1 python313-asteval-1.0.9-1.1 on GA media
These are all security issues fixed in the python313-asteval-1.0.9-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-67310
@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...
PT-2026-67096
Name of the Vulnerable Software and Affected Versions GamiPress versions prior to 7.9.9.2 Description The GamiPress plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. This...
PT-2026-67254
Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.23.1 Description A crafted HEIF sequence processed by the heif context read from memory function can result in a context with no registered sequence tracks. This leads to a crash when the heif context get trackctx, ...
PT-2026-67288
Name of the Vulnerable Software and Affected Versions Wazuh workflows versions prior to 44bf114 Description A shell injection issue exists in GitHub Actions where attackers can execute arbitrary commands by submitting pull requests containing crafted VERSION.json files. This occurs because shell...