25827 matches found
CVE-2025-69135: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin = 2.7.2 versions...
CVE-2026-12449: Use After Free
Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: High...
CVE-2026-40749: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...
CVE-2026-25446: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...
CVE-2026-39433: Missing Authorization
Subscriber Arbitrary Content Deletion in WPAMS 49.5.3 versions...
CVE-2026-54804: Authentication Bypass Using an Alternate Path or Channel
Subscriber Broken Authentication in Melhor Envio = 2.16.3 versions...
CVE-2026-46964: Undefined Security Weakness
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...
CVE-2025-69137: Missing Authorization
Subscriber Broken Access Control in Genemy = 1.6.6 versions...
CVE-2026-40723: Missing Authorization
Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...
CVE-2025-60218: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in PT Luxa Addons = 1.2.2 versions...
CVE-2026-46965: Undefined Security Weakness
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...
CVE-2026-7850: Undefined Security Weakness
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks...
CVE-2026-45436: Missing Authorization
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
CVE-2026-46966: Undefined Security Weakness
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...
CVE-2026-46963: Undefined Security Weakness
Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite component: Work Provider Site Level Administration. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...
CVE-2026-39546: Incorrect Privilege Assignment
Subscriber Privilege Escalation in MultiLoca = 4.2.15 versions...
CVE-2026-48967: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...
CVE-2026-49133: Improper Limitation of a Pathname to a Restricted Directory
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile with an empty folder...