361278 matches found
EUVD-2026-58836
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...
CVE-2026-16080
The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
CVE-2026-15312 Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...
CVE-2026-15312
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...
EUVD-2026-58834
The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
CVE-2026-15312 Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted...
CVE-2026-15312
The CVE-2026-15312 entry concerns the Propovoice: All-in-One Client Management System WordPress plugin. Affected versions up to 1.7.8 are vulnerable to privilege escalation via the plugin’s REST create() endpoint, which fails to validate the user-supplied role against an allowlist and omits a pro...
CVE-2026-14433 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-58833
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-14433 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-14433
The CVE-2026-14433 entry describes a Stored Cross-Site Scripting (XSS) vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress. The flaw affects the REST API via the business_id parameter and is present in all versions up to and including 4.6.0, due t...
CVE-2026-14433
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...
GHSA-XC2P-8GGW-6CR5 vulnerabilities
Vulnerabilities for packages: grpcurl-fips, crossplane-provider-aws-neptune, wavefront-collector-for-kubernetes, crossplane-provider-aws-rds-fips, crossplane-provider-aws-ecr-fips, kaf, git-credential-oauth, redis-operator-fips, crane-fips, kubevirt-cdi-operator, envoy-gateway-fips,...
GHSA-XPHW-4F88-5F39 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-redshift, ollama, rancher-webhook-fips, aws-efs-csi-driver-fips, nrdot-collector-k8s-fips, harbor-registry, terraform-mcp-server, crossplane-provider-aws-wafregional-fips, gogatekeeper, crossplane-provider-aws-neptune,...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: grpcurl-fips, crossplane-provider-aws-neptune, wavefront-collector-for-kubernetes, crossplane-provider-aws-rds-fips, crossplane-provider-aws-ecr-fips, kaf, git-credential-oauth, redis-operator-fips, crane-fips, kubevirt-cdi-operator, envoy-gateway-fips,...
GHSA-76P8-FHRM-VPC7 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-redshift, ollama, kubernetes-csi-driver-nfs-fips, rancher-webhook-fips, aws-efs-csi-driver-fips, nrdot-collector-k8s-fips, harbor-registry, crossplane-provider-aws-wafregional-fips, gogatekeeper, crossplane-provider-aws-neptune, gatus-fips,...
GHSA-7QCH-W8M5-G3H3 vulnerabilities
Vulnerabilities for packages: grpcurl-fips, crossplane-provider-aws-neptune, wavefront-collector-for-kubernetes, crossplane-provider-aws-rds-fips, crossplane-provider-aws-ecr-fips, kaf, git-credential-oauth, redis-operator-fips, crane-fips, kubevirt-cdi-operator, envoy-gateway-fips,...
GHSA-C974-W86C-VPFW vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-redshift, ollama, kubernetes-csi-driver-nfs-fips, rancher-webhook-fips, aws-efs-csi-driver-fips, nrdot-collector-k8s-fips, harbor-registry, terraform-mcp-server, crossplane-provider-aws-wafregional-fips, gogatekeeper, grpcurl-fips,...
GHSA-QV9R-C865-CP47 vulnerabilities
Vulnerabilities for packages: solr, celeborn, akhq, infinispan, spark, apache-tika, spdx-tools-java, druid, wavefront-proxy, neo4j, sonarqube, apache-activemq-artemis, apache-pulsar, kafka, keycloak-config-cli, kserve-modelmesh, opensearch, flink, strimzi-kafka-operator, wildfly, thingsboard, zip...
CVE-2026-49844 vulnerabilities
Vulnerabilities for packages: solr, celeborn, akhq, infinispan, spark, apache-tika, spdx-tools-java, druid, wavefront-proxy, neo4j, sonarqube, apache-activemq-artemis, apache-pulsar, kafka, keycloak-config-cli, kserve-modelmesh, opensearch, flink, strimzi-kafka-operator, wildfly, thingsboard, zip...