17405 matches found
WordPress WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards plugin <= 5.5.31 - Unauthenticated Reflected Cross-Site Scripting vulnerability
Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin WP Data Access versions = 5.5.31...
WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.7 - Unauthenticated Reflected Cross-Site Scripting vulnerability
Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin WPBITS Addons For Elementor Page Builder versions = 1.7...
WordPress plugin Elementor Website Builder cross-site scripting vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...
CVE-2026-6127: Improper Neutralization of Input During Web Page Generation
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the elementordata meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the...
CVE-2026-39666
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in telepathy Hello Bar Popup Builder hellobar allows DOM-Based XSS.This issue affects Hello Bar Popup Builder: from n/a through = 1.5.1...
WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Profile Builder Pro versions = 3.15.0...
WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by daroo in WordPress Plugin Funnel Builder by FunnelKit versions = 3.15.0.1...
[SECURITY] Fedora 44 Update: flatpak-builder-1.4.8-1.fc44
Flatpak-builder is a tool for building flatpaks from sources. See https://flatpak.org/ for more information...
Fedora 44 : flatpak-builder (2026-5e62b78a0c)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5e62b78a0c advisory. This update includes a fix for CVE-2026-39977. See also: the upstream advisory Tenable has extracted the preceding description block directly from the Fedora...
act-workflow (>=4.8.2, <=4.8.399), agent-builder (0.0.1) +13 more potentially affected by CVE-2026-41488 via langchain-openai (0.2.2)
langchain-openai PYPI version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - act-workflow =4.8.2, =0.1.5, =0.0.1, =0.1.0, =0.4.16, =0.4.15, =0.5.0, =0.5.1 Source cves: CVE-2026-41488 Source advisory:...
@christianhugo/mobile-builder (>=0.7.3-beta.3, <=0.7.4-beta.9), @christianhugoch/cli (>=0.7.2-beta.12, <=0.7.2-beta.13) +4 more potentially affected by CVE-2026-41478 via @saltcorn/server (>=0.0.2, <=1.4.5)
@saltcorn/server NPM version =0.0.2, =0.7.3-beta.3, =0.7.2-beta.12, =0.0.2, =0.7.2-beta.5, =0.0.2, =0.2.3 Source cves: CVE-2026-41478 Source advisory: MEND:CVE-2026-41478...
@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5)
@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: MEND:CVE-2026-41478...
@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.4) potentially affected by CVE-2026-41478 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.4)
@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-41478 Source advisory: MEND:CVE-2026-41478...
@christianhugo/mobile-builder (0.7.3-beta.3), @saltcorn/mobile-builder (>=0.7.2-beta.6, <=0.7.3-beta.3) potentially affected by CVE-2026-41478 via @saltcorn/cli (>=0.7.2-beta.5, <=0.7.3-beta.3)
@saltcorn/cli NPM version =0.7.2-beta.5, =0.7.2-beta.6, =0.7.3-beta.3 Source cves: CVE-2026-41478 Source advisory: MEND:CVE-2026-41478...
CVE-2026-2028
The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxiremovecustomimagesize' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-leve...
CVE-2026-2028
The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxiremovecustomimagesize' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-leve...
CVE-2026-2028
The MaxiBlocks Builder plugin for WordPress contains an issue where the maxi_remove_custom_image_size AJAX action inadequately validates file ownership, allowing authenticated users with Author-level access or higher to delete arbitrary files in wp-content/uploads (including files from others/adm...
CVE-2026-2028 Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter
The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxiremovecustomimagesize' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-leve...
EUVD-2026-25372
The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxiremovecustomimagesize' AJAX action in all versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with Author-leve...