WordPress Easy Forms for Mailchimp Plugin < 6.8.9 - Cross-Site Scripting

The Easy Forms for Mailchimp plugin before version 6.8.9 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the sqlerror parameter before outputting it back in the page when the debug option is enabled, which could allow attackers to execute...

subcrawl

SubCrawl SubCrawl is a framework developed by Patrick Schläpfer, Josh Stroschein and Alex Holland of HP Inc’s Threat Research team. SubCrawl is designed to find, scan and analyze open directories. The framework is modular, consisting of four components: input modules, processing modules, output...

libptrace

libptrace libptrace is an event driven process/thread debugging, tracing, and manipulation framework. It is written in C and has Python 2.7 and 3.7 bindings. It is meant to be used as a library. The API has been designed with cross-platform support in mind. Although the current version only runs ...

VulnCheck KEV: CVE-2025-13516

The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's savefile function in inc/emails/handler/uploads.php which duplicates all email attachments to a web-accessibl...

heartbleed

Heartbleed A checker site and tool for CVE-2014-0160. Software from@FiloSottile for iSC Inc...

CVE-2026-124599: GeoVision Inc. GV-Face: The RSA cryptographic key material, including a private key and public key, is embedded within the application package

The RSA cryptographic key material, including a private key and public key, is embedded within the application package. Because Android applications can be extracted and reverse engineered, storing private cryptographic keys directly inside the client application may allow an attacker to recover...

CVE-2026-119474

Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81...

PT-2026-140420

Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81...

CVE-2026-119474: HAVELSAN Inc. Liman Render Engine: Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc

Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81...

CVE-2026-121784

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. WpBookingly service-booking-manager allows Stored XSS.This issue affects WpBookingly: from n/a through 1.4.3...

CVE-2026-120839

The Magepeople inc. WpTravelly tour-booking-manager WordPress plugin is vulnerable to Local File Inclusion (LFI) in versions 2.3.8 and below . This flaw stems from Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98), allowing an attacker to include local files on th...

EUVD-2026-119250

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

EUVD-2026-119249

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

EUVD-2026-119219

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magepeople inc. WpBookingly service-booking-manager allows Stored XSS.This issue affects WpBookingly: from n/a through 1.4.3...

PT-2026-139458

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8...

PT-2026-139455

The Image Hover Effects Ultimate Visual Composer Flipbox - Awesomes Flip Boxes Image Overlay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-a...

spip-cve-2026

SPIP 4.4.16 - CVE-2026-72708 and CVE-2026-109378 Reproducible proof of concept material for two vulnerabilities I reported in SPIP, both fixed in 4.4.18. CVE| Class| Auth| CVSS 4.0| Sink ---|---|---|---|--- CVE-2026-72708| Blind SQL injection CWE-89| none| 8.7 High| ecrire/req/mysql.php:1730...

CVE-2026-120065

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120059

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT,...

CLEANSTART-2025-NI15837 mem_get_bits_rectangle function in Artifex Software, Inc

Security vulnerability affects the ghostscript package. The memgetbitsrectangle function in Artifex Software, Inc...