75378 matches found
CVE-2026-81638
Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...
WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier vulnerability
Unauthenticated Account Takeover via 'acfobjects' Object Identifier vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...
PT-2026-86922
Improper Handling of Alternate Encoding vulnerability in ash-project ash double entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, ...
MINI-2JQ8-G659-39J6
Bulletin has no description...
CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...
MINI-QFRM-G6X5-3RCF
Bulletin has no description...
MINI-V4XJ-6FMG-QP3M
Bulletin has no description...
MINI-R4Q5-9RX9-FFMG
Bulletin has no description...
MINI-343Q-V7PW-R7GH
Bulletin has no description...
MINI-H3CV-JP93-CQ4C
Bulletin has no description...
MINI-CHF7-P5V9-275R
Bulletin has no description...
MINI-XF2W-3G72-82GX
Bulletin has no description...
MINI-6WCG-95J7-M3CJ
Bulletin has no description...
MINI-R2F7-J845-4P75
Bulletin has no description...
CVE-2026-84221
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
EUVD-2026-71862
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
MINI-6CH5-FQ38-P9VC
Bulletin has no description...
MINI-682G-764H-836V
Bulletin has no description...
PT-2026-86346
🚨 CVE-2026-84221 The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials. 🎖@cveNotify...