67380 matches found
Calibre <= 7.14.0 Remote Code Execution
Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6782 info: name: Calibre = 7.14.0 Remote Code Execution author: DhiyaneshDK severity: critical description: | Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0...
PT-2026-104510
Name of the Vulnerable Software and Affected Versions Transliterator – Multilingual and Multi-script Text Conversion versions prior to 2.5.9 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment...
PT-2026-104548
Name of the Vulnerable Software and Affected Versions Nelio Content – Editorial Calendar & Social Media Auto-Posting versions prior to 4.5.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows...
CVE-2026-80517: Improper Neutralization of Input During Web Page Generation
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site...
CVE-2026-105117: Improper Input Validation
OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/realm/users. Attackers can supply subject and message fields to send phishing mail from the...
CVE-2026-97660: Improper Neutralization of Input During Web Page Generation
The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo- Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...
CVE-2026-85568: Improper Neutralization of Special Elements used in an SQL Command
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set...
CVE-2026-101161: Uncontrolled Resource Consumption
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin...
PT-2026-104507
Name of the Vulnerable Software and Affected Versions Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress versions prior to 1.10.42 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to...
CVE-2026-96575: Improper Neutralization of Input During Web Page Generation
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable rstrkeep Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-94505: Missing Authorization
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
PT-2026-104524
Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description An issue exists where search values are not correctly handled before rewriting a prepared SQL statement. This allows unauthenticated users to perform SQL...
PT-2026-104561
In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec. 9.1 pairs the two, requiring that authAttrs be present whenever...
Linux Distros Unpatched Vulnerability : CVE-2026-71892
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients,...
PT-2026-104483
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...
PT-2026-104551
Name of the Vulnerable Software and Affected Versions WPC Product Options for WooCommerce versions prior to 4.0.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. The issue occurs when a malicious payload is...
PT-2026-104578
Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An email content injection issue allows unauthenticated attackers to control the wording of notification emails. This is possible through the forgotPassword and register actions on the...
CVE-2026-101923: Missing Authorization
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcprimageuploadid parameter of a public review submission into the review's...
