25090 matches found
CVE-2026-66437
Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...
CVE-2026-65567
The vulnerability concerns the WordPress Event Tickets plugin for WordPress, affected in versions ≤ 5.29.0.1. It is described as an Unauthenticated Broken Access Control flaw, meaning unauthenticated users can access restricted functionality or data. The CVE-2026-65567 entry confirms the issue wi...
CVE-2026-65567 WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...
CVE-2026-65558
CVE-2026-65558 concerns the WordPress AffiliateX plugin, affected through version <= 2.3.5, with an unauthenticated Server Side Request Forgery (SSRF) vulnerability. The Patchstack entry characterizes the impact as CVSSv3.1: Network attack vector, high attack complexity, no privileges required...
EUVD-2026-49228
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...
WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Addons for Contact Form 7 versions =3.5.45...
ai-pentest-agent
AI Pentest Agent 🛡️🤖 The first open-source autonomous AI pe...
WordPress Checkout Field Editor for WooCommerce – Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Checkout Field Editor for WooCommerce Checkout Manager versions = 3.0.5...
Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in activemq-all jar
Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-42253, CVE-2026-42588, CVE-2026-45505, CVE-2026-46605, CVE-2026-49157, CVE-2026-49270 reported for activemq-all-5.19.0.jar Vulnerability Details CVEID:CVE-2026-42253 DESCRIPTION: Improper Neutralization of Input...
WordPress Contact Form 7 plugin < 2.5 - Open Redirect vulnerability
Open Redirect vulnerability discovered by Pedro Antunes in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions 2.5...
CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all...
CVE-2026-12982
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...
PT-2026-64957
Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...
PT-2026-65095
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...
PT-2026-65315
Name of the Vulnerable Software and Affected Versions miniorange otp verification versions prior to 5.5.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update minioran...
PT-2026-64853
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...
CVE-2026-51077
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...
PT-2026-65318
Name of the Vulnerable Software and Affected Versions Ultimate Addons for Contact Form 7 versions prior to 3.5.46 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update...
CVE-2026-64208
In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...
CVE-2017-5011
creationtimestamp| type| source ---|---|--- 2026-07-26 07:02:10+00:00| seen| https://t.me/KaitNews/2842 2026-07-27 00:01:50+00:00| seen| https://t.me/KaitNews/2842 2026-08-05 18:00:04+00:00| seen| https://t.me/KaitNews/2842 2026-08-06 00:00:26+00:00| seen| https://t.me/KaitNews/2842...