25010 matches found
CVE-2026-3869
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...
CVE-2026-3869
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...
CVE-2026-3869
CVE-2026-3869 is a Critical (CVSS 4.0: 9.2) vulnerability in the Schneider Electric Modicon M580 programmable logic controller (PLC). The flaw is a CWE-303 (Incorrect Implementation of Authentication Algorithm) that can lead to loss of confidentiality, integrity, and availability of the PLC when ...
CVE-2026-3869
CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC...
GHSA-38XV-HF3P-H7MQ
creationtimestamp| type| source ---|---|--- 2026-09-11 11:32:31+00:00| seen| https://gist.github.com/alon710/31db43b5866ca861d12e36661fc88337...
CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress AI Builder plugin 2.4.1-2.7.7 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin AI Builder versions 2.4.1-2.7.7...
CVE-2026-64837
creationtimestamp| type| source ---|---|--- 2026-09-11 05:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv7tkbexcy2n...
CVE-2026-7438
The Bold Timeline Lite WordPress plugin (all versions up to and including 1.2.8 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the supertitle and subtitle attributes of the bold_timeline_item shortcode. The root cause is insufficient input sanitization and output escaping o...
CVE-2026-6640: Improper Neutralization of Input During Web Page Generation
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2026-90036
Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.1 versions...
CVE-2026-83546: Improper Neutralization of Input During Web Page Generation
The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...
CVE-2026-62132: Missing Authorization
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62102: Incorrect Privilege Assignment
Subscriber Privilege Escalation in Gato GraphQL = 19.2.3 versions...
CVE-2026-89010: Improper Neutralization of Special Elements used in an OS Command
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the syncserver daemon on TCP port 13136. The daemon...
CVE-2024-12145: Missing Authorization
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2026-11496: Missing Authorization
The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...
CVE-2026-85678: Improper Neutralization of Input During Web Page Generation
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...
CVE-2026-14565: Improper Neutralization of Input During Web Page Generation
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...