718767 matches found
CLSA-2026-1777643521 Fix of 13 CVEs
Ubuntu: 4.15.0-255.266 CVE-2026-31431 - crypto: authencesn - reject too-short AAD assoclen8 to match ESP/ESN spec CVE-2026-31431 - crypto: scatterwalk - Backport memcpysglist CVE-2026-31431 - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption CVE-2026-31431 - crypto...
WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin WPMobile.App versions = 11.86...
WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ravenska Dhigna Manggala in WordPress Plugin Knit Pay versions = 9.6.3.0...
WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ravenska Dhigna Manggala in WordPress Plugin Car Rental Manager versions = 1.5.3...
DEBIAN-CVE-2026-71195
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...
CVE-2026-71195
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...
CVE-2026-79627
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone w...
CVE-2026-105262
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output...
CVE-2026-102499
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...
EUVD-2026-107081
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone w...
EUVD-2026-107062
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide...
CVE-2026-105262 Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output...
CVE-2026-105262 Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output...
EUVD-2026-107052
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output...
CVE-2026-105262
The Falang multilanguage for WordPress plugin version before 1.4.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability checks when saving term translations and the exposure of a valid nonce to any logged-in user via an unprotected handler. This allows users...
CVE-2026-102499
The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins, in versions before 7.37.0 , are vulnerable to SQL Injection via the mec_attendees AJAX Action . The root cause is the failure to properly sanitise and escape a parameter used within a SQL statement. This allows authe...
EUVD-2026-107049
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...
CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...
CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...
CVE-2026-71195
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual...