178241 matches found
MINI-2MFR-C44J-GCW4
Bulletin has no description...
EUVD-2026-59956
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...
CVE-2026-74790
Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its...
MINI-R5JF-XFGM-G3PV
Bulletin has no description...
MINI-HC48-RFPH-M693
Bulletin has no description...
MINI-W5VM-FMW6-934W
Bulletin has no description...
MINI-7RJ6-XW76-Q2FJ
Bulletin has no description...
CVE-2026-19726
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...
CVE-2026-19717
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders whi...
CVE-2026-19728
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...
CVE-2026-19726 Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...
CVE-2026-19726
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...
CVE-2026-19726
The Visualizer WordPress plugin before version 4.0.7 contains an incorrect authorization vulnerability. It fails to properly restrict access to chart configurations, enabling users with the Contributor role and above to view the full configuration of any chart on the site. This includes configura...
CVE-2026-19717
The CatFolders Document Gallery & PDF Library WordPress plugin, in versions before 2.0.7 , is vulnerable to an unauthenticated attachment disclosure due to missing authorization checks in certain REST API endpoints . This flaw allows unauthenticated users to retrieve the title, type, size, and UR...
CVE-2026-19717
The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders whi...
CVE-2026-19728
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...
EUVD-2026-59920
The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...
EUVD-2026-59919
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...
CVE-2026-19613 ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source
The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...
CVE-2026-19613
The ECS (Ele Custom Skin) for Elementor WordPress plugin versions before 4.3.10 is vulnerable to unauthorized data disclosure. The root cause is a failure to perform ownership or post-status checks when a dynamic repeater data source reads custom field values using a user-supplied post identifier...