6638 matches found
EUVD-2026-44899
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-15021 wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-15021
The wpForo Forum plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the 'location' Profile Field across all versions up to 3.1.1. The issue stems from insufficient input sanitization and output escaping; sanitize_text_field() at input does not encode double q...
ECHO-D1C9-E9B0-A1C1
Bulletin has no description...
MINI-F595-GM2V-C2XF
Bulletin has no description...
MINI-9G2H-8Q4X-C2VF
Bulletin has no description...
CGA-HRJ4-W5MJ-QH2C
Bulletin has no description...
CVE-2026-40952
The CVE-2026-40952 entry describes a privilege misconfiguration in the Windows Secure Access installer for the client and server prior to version 14.55. Local attackers with access to the affected system can elevate privileges to Administrator when Secure Access is installed in a non-default loca...
CVE-2026-15392 DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The completetablename method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any...
SUSE-SU-2026:2982-1 Security update for python-WebOb
This update for python-WebOb fixes the following issue - CVE-2026-44889: Location header normalization during redirect leads to open redirect bsc1268324...
CVE-2026-12511
The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal...
CVE-2026-0487
SAProuter on Microsoft Windows allows an unauthenticated attacker to load library DLL files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impac...
PT-2026-58062
Name of the Vulnerable Software and Affected Versions DBD::File versions prior to 1.651 Description The software fails to verify if a table file is a symbolic link to an untrusted location. The complete table name function constructs the absolute path to the table file without checking for symbol...
MAL-2026-10467 Malicious code in polymarket-stake-kelly-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01715ebd11c8adf6ac26ce11bc5fc07e6cfb6775fa77dbe1ca022d0d6593b99c [email protected] ships a postinstall script scripts/install-check.cjs referenced by package.json's postinstall hook that on every np...
PYSEC-2026-2554 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
Summary Several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the RemoteFacilityUser viewsets; remediation review found two...
CVE-2026-57743
creationtimestamp| type| source ---|---|--- 2026-07-13 10:47:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjjbruxca2l 2026-07-13 22:11:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkpjijgpa2a 2026-07-16 08:11:42+00:00| seen|...
MINI-7H65-9JJQ-6779
Bulletin has no description...
MINI-5MWG-R4VX-V3XF
Bulletin has no description...