27940 matches found
PT-2026-86524
wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...
Malicious Package
Overview guci-date is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
DRUPAL-CONTRIB-2026-133
This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+...
MGASA-2026-0361 Updated perl-Date-Manip packages fix security vulnerabilities
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime...
MGASA-2026-0362 Updated perl-HTTP-Date packages fix a security vulnerability
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate...
Updated perl-Date-Manip packages fix security vulnerabilities
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime...
Updated perl-HTTP-Date packages fix a security vulnerability
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate...
CVE-2026-75965
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...
EUVD-2026-68972
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...
CVE-2026-75965
The User Profile Builder WordPress plugin (versions ≤ 4.0.0 ) is vulnerable to Stored Cross-Site Scripting via the 'date' Shortcode Attribute , caused by insufficient input sanitization and output escaping in the format-date shortcode. Authenticated users with contributor-level access or higher c...
CVE-2026-75965 User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...
CVE-2026-75965: Improper Neutralization of Input During Web Page Generation
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...
Alibaba Cloud Linux 3 : 0279: perl-Date-Manip (ALINUX3-SA-2026:0279)
The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0279 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-60075: Date::Manip versions through 6.99 f...
WordPress User Profile Builder plugin <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Profile Builder versions = 4.0.0...
OESA-2026-3539 perl-Date-Manip security update
Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times,determining a date a given amount of time from another, or parsing international times are all easily done. It deals with time as it is used in the Gregorian...
CVE-2026-75847
creationtimestamp| type| source ---|---|--- 2026-08-30 02:20:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/7pvs4t4e5e2fq...
CVE-2026-76546
The User Profile Builder WordPress plugin, in versions prior to 4.0.1 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape the output of one of its optional shortcodes, specifically the Format Date shortcode. This allows users with permissions as low as Con...
CVE-2026-76546 Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...
CVE-2026-76546 Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...