25106 matches found
CVE-2026-30853 calibre has a Path Traversal Leading to Arbitrary File Write
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook .rb input plugin src/calibre/ebooks/rb/reader.py allows an attacker to write arbitrary files to any path writable by the calibre...
CVE-2026-30853 calibre has a Path Traversal Leading to Arbitrary File Write
calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook .rb input plugin src/calibre/ebooks/rb/reader.py allows an attacker to write arbitrary files to any path writable by the calibre...
Infinite loop
Overview Affected versions of this package are vulnerable to Infinite loop through the archivereaddata process. An attacker can exhaust system resources by submitting a specially crafted RAR5 archive that triggers an infinite loop during decompression. Remediation Upgrade libarchive to version...
MINI-2XCP-8V35-QHRP
Bulletin has no description...
CVE-2026-32461 WordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Really Simple SSL: from n/a through = 9.5.7...
CVE-2026-32454
CVE-2026-32454 describes a DOM-based XSS in the WordPress Avada Core plugin’s fusion-core component, triggered by improper input neutralization during web page generation. Affected software is Avada Core fusion-core, with versions before 5.15.0. The impact is DOM-based XSS; explicit exploitation ...
CVE-2026-32453
CVE-2026-32453 concerns WordPress plugin Avada Core (fusion-core). The vulnerability is a Missing Authorization issue due to incorrectly configured access control, affecting Avada Core versions from n/a up to
CVE-2026-32453
Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avada Core: from n/a through 5.15.0...
CVE-2026-32422
The CVE affects WordPress WP EasyCart plugin versions
CVE-2026-32422 WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through = 5.8.13...
CVE-2026-32418
CVE-2026-32418 affects the WordPress plugin Meow Gallery (version
CVE-2026-32397
CVE-2026-32397 affects the WordPress plugin “YMC Filter & Grids” (ymc-smart-filter) up to version 3.5.1. The vulnerability is described as a Missing Authorization/broken access control issue that allows exploitation via incorrectly configured access levels. The connected CVE entries confirm the a...
CVE-2026-32396
Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through = 5.0.13...
CVE-2026-32356 WordPress Robo Gallery plugin <= 5.1.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in robosoft Robo Gallery robo-gallery allows DOM-Based XSS.This issue affects Robo Gallery: from n/a through = 5.1.2...
CVE-2026-32354 WordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through 5.1.9...
CVE-2026-32354
Insertion of Sensitive Information Into Sent Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Retrieve Embedded Sensitive Data.This issue affects WpEvently: from n/a through 5.1.9...
MINI-PFH2-5PPC-5C33
Bulletin has no description...
MINI-VCH6-P5X8-GR6X
Bulletin has no description...
CVE-2026-3873
CVE-2026-3873 affects Avantra’s legacy built-in user account. The vulnerability arises from use of hard-coded credentials in Avantra systems and allows accessing functionality not properly constrained by ACLs in versions before 25.3.0. According to the provided metrics, the issue has CVSS 3.1 bas...