CVE-2023-38037

CVE-2023-38037 affects Rails’ ActiveSupport::EncryptedFile, which writes data to a temporary file with permissions derived from the user’s umask. The temporary file could be readable by other users on the same system while a user edits it, enabling local information disclosure. Public documents f...

CVE-2023-28120

CVE-2023-28120 affects ActiveSupport: invoking the new bytesplice method on a SafeBuffer with untrusted input can lead to cross-site scripting (CWE-79). Connected sources confirm the vulnerability exists, but the provided documents do not specify affected versions or a fixed patch version. There ...

CVE-2023-35685

CVE-2023-35685 describes a logic error in DevmemIntMapPages within the file devicemem_server.c that can cause a physical page use-after-free. This USE-After-FREE condition could enable local privilege escalation in the kernel without requiring additional execution privileges or user interaction. ...

CVE-2023-23672

CVE-2023-23672 concerns WordPress plugin GiveWP (Liquid Web/StellarWP) up to version 2.25.1, with a Missing Authorization vulnerability in a function affecting content deletion. The issue allows an authenticated user with Contributor privileges to delete arbitrary content due to insufficient auth...

CVE-2023-45272

CVE-2023-45272 affects WordPress plugin 10Web Map Builder for Google Maps (versions

CVE-2023-45633

CVE-2023-45633 describes a Missing Authorization vulnerability (Broken Access Control) in WordPress IMPress Listings plugin (versions n/a–2.6.2). The root cause is incorrectly configured access control security levels, enabling unauthenticated users to access restricted functionality. Reported CV...

CVE-2022-41995

CVE-2022-41995 concerns the WordPress plugin Gallery Images Ape, affected versions 2.2.8 and earlier. Multiple connected sources describe a Missing Authorization / Broken Access Control vulnerability, caused by incorrectly configured access control security levels in the Gallery Images Ape plugin...

CVE-2022-43476

CVE-2022-43476 relates to the WordPress plugin Subscribe to Category (affected versions:

CVE-2023-47778

CVE-2023-47778 concerns LuckyWP Scripts Control for WordPress. The vulnerability is a Missing Authorization/Broken Access Control issue in LuckyWP Scripts Control versions

CVE-2023-47807

CVE-2023-47807 — Missing Authorization in WordPress plugin 10WebAnalytics (

CVE-2023-48739

CVE-2023-48739 affects the Porto Theme - Functionality WordPress plugin (pre-2.12.1). The issue is a Missing/Broken Access Control vulnerability allowing unauthenticated access due to incorrectly configured authorization. The CVSSv3.1 base score is 5.3 (Medium) with Low availability impact per Pa...

CVE-2023-48758

CVE-2023-48758 affects Crocoblock JetEngine WordPress plugin. Versions

CVE-2023-47693

CVE-2023-47693 affects Themefic Ultimate Addons for Contact Form 7 (plugin:Ultimate Addons for Contact Form 7) up to version 3.2.6. The issue is a Broken Access Control allowing unauthenticated access due to misconfigured authorization. CVSS v3.1 base score cited as 7.5 (HIGH). Patch guidance fro...

CVE-2023-47692

CVE-2023-47692 is a WordPress Flo Forms plugin vulnerability (affected versions

CVE-2023-47689

CVE-2023-47689 corresponds to a Missing Authorization (Broken Access Control) issue in the WordPress Animator plugin (versions <= 3.0.10) where unauthenticated users can change plugin settings. The vulnerability is documented with CVSS 3.1/6.5 (Medium) and is explicitly mitigated by a fix in v...

CVE-2023-47661

CVE-2023-47661 affects Dragfy Addons for Elementor (WordPress) and is a Missing Authorization/Broken Access Control issue. Affected versions are Dragfy Addons for Elementor

CVE-2023-47648

CVE-2023-47648: WordPress plugin EazyDocs (Spider Themes)

CVE-2023-47557

CVE-2023-47557 refers to a Missing Authorization vulnerability in the WordPress plugin Visitors Traffic Real Time Statistics (versions

CVE-2023-47523

CVE-2023-47523 is a Missing Authorization vulnerability in the WordPress plugin Auto Tag Creator (

CVE-2023-47515

CVE-2023-47515 concerns the WordPress plugin “Seers – GDPR & CCPA Cookie Consent & Compliance”. Connected sources confirm a Missing Authorization/Broken Access Control issue affecting Seers versions up to 8.1.1, allowing unauthenticated access to configured security levels. The root cause is insu...