27482 matches found
CVE-2026-2431 CM Custom Reports <= 1.2.7 - Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameters
The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datefrom' and 'dateto' parameters in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-2431
CVE-2026-2431 affects the CM Custom Reports plugin for WordPress. All versions up to and including 1.2.7 are vulnerable due to insufficient input sanitization and output escaping on the date_from/date_to parameters, enabling a reflected Cross-Site Scripting (XSS) attack. This allows unauthenticat...
Freedom Factory dGEN1 授权问题漏洞
The Freedom Factory dGEN1 is a Ethereum mobile device produced by the Freedom Factory company. Versions of Freedom Factory dGEN1 dated back to 20260221 and earlier contained an authorization issue vulnerability. This vulnerability stemmed from incorrect operations on the FakeAppProvider function...
Freedom Factory dGEN1 授权问题漏洞
The Freedom Factory dGEN1 is a Ethereum mobile device produced by the Freedom Factory company. Versions of the Freedom Factory dGEN1 dated 20260221 and earlier have a licensing issue vulnerability. This vulnerability stems from incorrect operations on the AlarmService function in the com.dgen.ala...
WordPress plugin CM Custom Reports 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
PT-2026-23815
The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date from' and 'date to' parameters in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-30244
creationtimestamp| type| source ---|---|--- 2026-03-06 23:48:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mggisvjt5g2y 2026-03-07 09:05:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghhx5epgt2u...
Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...
GHSA-MQ4R-H2GH-QV7X Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint
Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...
CVE-2026-30846
creationtimestamp| type| source ---|---|--- 2026-03-06 21:04:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg7mjmbwh2n...
CVE-2026-30847
creationtimestamp| type| source ---|---|--- 2026-03-06 20:54:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgg72mcthh2d...
GHSA-W6VW-MRGV-69VF
creationtimestamp| type| source ---|---|--- 2026-03-06 20:09:04+00:00| seen| https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/ 2026-03-10 23:10:58+00:00| seen|...
CVE-2025-69644
creationtimestamp| type| source ---|---|--- 2026-03-06 19:00:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfyps4ynz2k 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...
CVE-2026-29122
International Data Casting IDC SFX2100 satellite receiver comes with the /bin/date utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file...
CVE-2018-25188
creationtimestamp| type| source ---|---|--- 2026-03-06 14:07:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfid75x6u24...
CVE-2018-25189
creationtimestamp| type| source ---|---|--- 2026-03-06 13:54:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfhlde5ii2e...
CVE-2026-30885
creationtimestamp| type| source ---|---|--- 2026-03-06 13:27:33+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-6w2r-cfpc-23r5...
CVE-2026-29059
creationtimestamp| type| source ---|---|--- 2026-03-06 13:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgfffrkmn22w 2026-04-14 20:03:14+00:00| published-proof-of-concept| Telegram/P20Htht508gPcGtfhYsw3BkHMYZAVXCzBRlMvbh3o3mGtY 2026-06-03 04:09:58+00:00| confirmed|...
CVE-2026-23097
creationtimestamp| type| source ---|---|--- 2026-03-06 13:10:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgff4w63em24 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-03-20 13:05:29+00:00| seen|...