16828 matches found
CVE-2026-42385: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...
CVE-2026-54194: Deserialization of Untrusted Data
Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...
CVE-2026-45436: Missing Authorization
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
PT-2026-50414
Name of the Vulnerable Software and Affected Versions Fusion Builder versions prior to 3.15.5 Description A path traversal issue allows users with the Contributor role to delete arbitrary files on the server. Recommendations Limit user roles as a temporary mitigation measure. At the moment, there...
CVE-2026-40723: Missing Authorization
Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...
PT-2026-50327
Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...
PT-2026-50312
Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...
CVE-2026-54193: Improper Limitation of a Pathname to a Restricted Directory
Contributor Arbitrary File Deletion in Fusion Builder = 3.15.4 versions...
PT-2026-50329
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
GHSA-X6QJ-4H56-5RJ5 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Summary This is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address e.g. nuxt dev --host and the developer opens a malicious site on the same network. Details The fix for...
EUVD-2026-36421
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent incomplete fix for GHSA-6m52-m754-pw2g...
CVE-2026-54194 WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...
CVE-2026-54194
CVE-2026-54194 concerns the WordPress Fusion Builder plugin, affected versions ≤ 3.15.4, with a PHP Object Injection vulnerability identified in the CVE record. The provided information confirms the affected component (Fusion Builder), the vulnerable version range, and the nature of the issue (PH...
CVE-2026-54194 WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...
WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by daroo in WordPress Plugin Fusion Builder versions = 3.15.4...
XML External Entity (XXE) Injection
Spring Web Services is vulnerable to XML External Entity XXE Injection. The vulnerability is due to Jaxp13XPathTemplate using a code path for StreamSource and SAXSource inputs that parses attacker-controlled XML with the default DocumentBuilderFactory configuration instead of Spring's hardened XM...
Malicious Package
Overview npmjs-doc-builder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2026-50127
Name of the Vulnerable Software and Affected Versions Fusion Builder versions prior to 3.15.5 Description A PHP Object Injection issue exists in the software. This occurs when an application deserializes untrusted data, allowing an attacker to manipulate the objects created and potentially execut...
