21472 matches found
openjdk: Enhance Jar file processing (Oracle CPU 2026-07)
A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...
WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by qdtad in WordPress Plugin GamiPress versions = 7.9.7...
CVE-2026-65538
CVE-2026-65538 : WordPress Machete plugin ≤ 5.2 contains a Cross Site Scripting (XSS) vulnerability in the author context. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The provided documents do not specify the exact vulnerable component, explo...
CVE-2026-65518
The CVE concerns the WordPress plugin “Accept Donations with PayPal & Stripe” (v <= 1.5.5) and reports a Cross Site Scripting (XSS) vulnerability. Affected product is the WordPress plugin; vulnerability arises from an XSS issue in versions up to 1.5.5 as described in the CVE records. Public re...
EUVD-2026-48119
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
CVE-2026-65498 WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Complianz = 7.5.0 versions...
EUVD-2026-48094
Author Cross Site Scripting XSS in HashThemes Demo Importer = 1.4.2 versions...
CVE-2026-65480
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1...
EUVD-2026-48085
Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12 versions...
EUVD-2026-48079
Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...
CVE-2026-65465
The CVE-2026-65465 entry concerns a Cross Site Scripting (XSS) vulnerability in WordPress JetElements For Elementor plugin versions <= 2.9.1.1. The CVSSv3.1 score is 6.5 (Medium) with network attack vector, low privileges, user interaction required, and changed scope. Impact is low on confiden...
CVE-2026-59522 WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability
Subscriber Broken Access Control in WP ERP = 1.17.5 versions...
EUVD-2026-48184
Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.34.0 versions...
EUVD-2026-48148
Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...
CVE-2026-25405
CVE-2026-25405 affects the WordPress eRoom plugin (≤ 1.7.1). It is a reported SQL Injection vulnerability. CVSSv3.1: 8.5 (HIGH), NETWORK, LOW privileges, no user interaction, confidentiality impact HIGH, integrity and availability variances (I: NONE, A: LOW), scope changed. Connected documents pr...
CVE-2025-68081
CVE-2025-68081 : A cross-site scripting (XSS) vulnerability affects the WordPress plugin WP-Polls in versions
EUVD-2026-47922
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...
CVE-2026-9729
The CVE-2026-9729 entry concerns the Webpushr Push Notifications plugin for WordPress (versions up to 4.39.0). It describes a Stored Cross-Site Scripting flaw in which unsanitized input from the webpushr_notification_title and webpushr_notification_body parameters is combined into HTML attribute ...
openjdk: Enhance Jar handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...
CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal
@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...