19036 matches found
CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
CVE-2026-14230
The ECS WordPress plugin (specifically Ele Custom Skin for Elementor ) versions before 4.3.8 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability or object-ownership checks on its Dynamic Repeater AJAX handlers . While these handlers are gated by a nonce, an...
CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
EUVD-2026-58857
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...
CVE-2026-18807: Missing Authorization
The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...
CVE-2026-14230: Improper Neutralization of Input During Web Page Generation
The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...
CVE-2026-15993: Improper Neutralization of Special Elements used in an SQL Command
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause in all versions up to, and including, 1.15.44 due to insufficient escaping on the user supplied...
PT-2026-72153
Name of the Vulnerable Software and Affected Versions Form Maker by 10Web versions prior to 1.15.45 Description An issue exists where authenticated attackers with subscriber-level access or higher can perform blind SQL Injection. This occurs due to insufficient escaping of user-supplied parameter...
Linux Distros Unpatched Vulnerability : CVE-2026-72028
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r...
CVE-2026-12366
Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...
MAL-2026-14039 Malicious code in @cdnshell/loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b572368b522527a308a0a8057b3b0945ded5c73f4dcad6ab738eaa2b7ddf6e3 Package presents itself as a CDN static-asset distribution library but ships 19 pre-compiled arm64 Mach-O binaries under 03payloads/ stager, kbridge,...
GO-2021-0113 vulnerabilities
Vulnerabilities for packages: gitleaks, dynamic-localpv-provisioner, vt-cli, k3d, terraform-provider-sendgrid-fips, dynamic-localpv-provisioner-fips, hey, terraform-provider-sendgrid...
GO-2021-0356 vulnerabilities
Vulnerabilities for packages: kubeflow-fips, kubeflow, dynamic-localpv-provisioner, k3d, terraform-provider-sendgrid-fips, dynamic-localpv-provisioner-fips, terraform-provider-sendgrid...
GO-2022-0411 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner...
GO-2022-0969 vulnerabilities
Vulnerabilities for packages: kubeflow-fips, grpcurl, kubeflow, dynamic-localpv-provisioner, k3d, wireguard-go, terraform-provider-sendgrid-fips, terraform-provider-sendgrid, kubeflow-katib, dynamic-localpv-provisioner-fips, hey, kube-state-metrics...
GO-2022-0322 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner...
GO-2022-0603 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner-fips, thanos-operator-fips, dynamic-localpv-provisioner, thanos-operator...
GO-2022-0968 vulnerabilities
Vulnerabilities for packages: kubeflow-fips, kubeflow, dynamic-localpv-provisioner, k3d, terraform-provider-sendgrid-fips, dynamic-localpv-provisioner-fips, terraform-provider-sendgrid...
