633 matches found
cve-2026-47777
CVE-2026-47777 — Mastodon Featured Collections Authorization Bypass Overview I responsibly disclosed a High Severity Authorization Bypass vulnerability affecting Mastodon's experimental Featured Collections federation pipeline. CVE ID: CVE-2026-47777 Affected Component...
CVE-2020-10131
CVE-2020-10131 - CVE-2020-10131 - SearchBlox Product before V-9.2.1 is Vulnerable to CSV macro injection. Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure encryption, and low total...
CVE-2026-19084
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...
CVE-2026-19084 Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...
CVE-2026-19084
shared-files-pro WordPress plugin versions before 1.7.70 fail to validate the file path supplied when creating a featured image. An unauthenticated attacker can exploit this to read arbitrary files from the server and republish their contents at a public URL, resulting in high confidentiality imp...
EUVD-2026-67569
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...
CVE-2026-54742
In Lemmy versions 0.19.18 through 0.19.19 and 1.0.0-alpha.20, the CollectionAdd::Featured and CollectionRemove handlers in crates/apub/activities/src/community/collection_add.rs and collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying post.co...
CVE-2026-54742 Lemmy: `CollectionAdd::Featured` does not check the post is in the community
Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction...
CVE-2026-66637
Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...
CVE-2026-66637
Contributor-level users can inject unsanitized JavaScript into the WordPress Featured Video Plus plugin (versions ≤ 2.3.3), enabling stored XSS that executes in victims' browsers (CVSS 6.5, medium). No fix version or exploit details are provided; monitor the Patchstack advisory for updates.
CVE-2026-66637 WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...
CVE-2026-66637
Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...
EUVD-2026-60922
Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...
WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...
PT-2026-77065
Name of the Vulnerable Software and Affected Versions Featured Video Plus versions prior to 2.3.4 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 2.3.3...
CVE-2026-73340
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
CVE-2026-73340
The CVE covers a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Featured Image from URL , affecting versions
EUVD-2026-57909
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...