83362 matches found
CVE-2026-14234
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...
CVE-2026-64554
No description is available for this CVE...
CVE-2026-5626
The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getalldata function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export a...
CVE-2026-5626 Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export
The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getalldata function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export a...
CVE-2026-5626
The CVE affects the WordPress plugin “Survey Form Block” (versions up to and including 1.0.1). A missing capability check in get_all_data() enables authenticated users with Subscriber-level access and above to export all survey submissions and column metadata. Public exploit details are not provi...
EUVD-2026-50109
The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
CVE-2026-12144
The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...
MINI-HGJV-F7V2-J43X
Bulletin has no description...
MINI-4485-9728-8GVM
Bulletin has no description...
CVE-2026-12144
CVE-2026-12144 affects the Wholesale for WooCommerce plugin for WordPress (all versions up to and including 2.0.5). The root cause is in save_requests_meta(): the user_role_set POST parameter is sanitized only with sanitize_text_field(), then passed directly to WP_User::add_role() without an allo...
ECHO-4DF1-D3CB-67CA
Bulletin has no description...
CGA-76X3-MVVQ-W6HW
Bulletin has no description...
PT-2026-65890
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check...
Linux Distros Unpatched Vulnerability : CVE-2026-62432
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset,...
Check Point Gaia Operating System (sk185152)
The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk185152 advisory. - An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remot...
Linux Distros Unpatched Vulnerability : CVE-2026-62430
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the...
UBUNTU-CVE-2026-50737
When applying replicated changes for a row that is missing one or more...
PT-2026-65696
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...