699186 matches found
CVE-2026-109590
The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.3.6 . The flaw exists within the ttbm_hotel_map_shortcode() function due to insufficient input sanitization and output escaping on the width, height, and zoom attribu...
CVE-2026-109381
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.7.8 . The vulnerability exists in the mep_grant_shop_manager_access() function, which hooks into user_has_cap and unconditionally grants the manage_options capability. This occurs when...
CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...
EUVD-2026-111735
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...
CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — mos...
edk2-security
EDK2 BrotliCustomDecompressLib — heap overflow unfixed A heap-buffer-overflow in EDK2's own Brotli decompression glue MdeModulePkg/Library/BrotliCustomDecompressLib, present since 2017, unfixed at HEAD as of 2026-10-25. ASAN-confirmed with a proof-of-concept and an end-to-end controlled-corruptio...
Malicious code in csvflow-schema (npm)
csvflow-schema is described as a "Lightweight CSV column-schema validation helper" index.js exports a small validateSchema function and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and...
Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in ip-address(CVE-2026-111997)
Summary IBM Db2 Developer Extension is affected by vulnerability in ip-addressCVE-2026-111997 Vulnerability Details CVEID:CVE-2026-111997 DESCRIPTION: ip-address before 10.7.4 allows a denial of service CPU consumption from quadratic complexity, and application stall via many % characters in inpu...
CVE-2026-15323
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...
CVE-2026-109236
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...
Qs : Qs.stringify With ArrayFormat 'comma' Throws An Uncaught TypeError On Array Elements Carrying A Non-callable Own To
Summary "qs.stringifyobj, arrayFormat: 'comma' " throws an uncaught "TypeError: Cannot convert object to primitive value" when an array in "obj" contains an element that carries an own, non-callable "toString" property for example " a: toString: 'x' ". A remote, unauthenticated attacker who can...
Nodemailer: Quadratic (O(n^2)) SMTP Client Reply Parsing Lets A Malicious Server Or MITM Cause A Pre-auth Remote Denial
Summary The SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial continuation reply on every line. The partial-response test runs "str.slicestr.lastIndexOf' ' + ...
Nodemailer: Quadratic Backtracking In SMTP AUTH Mechanism Detection Regexes Allows Pre-auth Remote Denial Of Service
Summary Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic On^2 backtracking whenever the mechanism name is...
CVE-2026-109236
The Customer Email Verification for WooCommerce plugin for WordPress (versions up to and including 2.8.2 ) is vulnerable to an Authentication Bypass via a predictable email-verification token. The root cause is the authenticate_user_by_email_link() function, which lacks capability checks and nonc...
EUVD-2026-111594
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...
CVE-2026-15323 Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...
CVE-2026-15323 Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...
CVE-2026-15323
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress (versions up to and including 2.1.2 ) is vulnerable to Directory Traversal via the process_checkout function. This flaw allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensiti...
CVE-2026-109236 Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the authenticateuserbyemaillink function — hooked on the wp action and triggered by th...
EUVD-2026-111595
The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the processcheckout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the serve...