Roundcube Webmail Project Roundcube Webmail Cross-site Scripting Vulnerability

The Roundcube Webmail project contains a cross-site scripting vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because the error messages returned by the password driver in the password plugin are concatenated into user messages without proper HTML...

Exploit for CVE-2026-52887

nocobase-cve-2026-52887 NocoBase security research and exploi...

WordPress CMP – Coming Soon & Maintenance plugin 4.1.19-4.1.20 - Unauthenticated Maintenance Mode Bypass vulnerability

Unauthenticated Maintenance Mode Bypass vulnerability discovered by Sanjeev Kumar in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.19-4.1.20...

WordPress Wava Payment Plugin plugin 0.3.1-0.3.9 - Unauthenticated Merchant Credential Overwrite vulnerability

Unauthenticated Merchant Credential Overwrite vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Wava Payment versions 0.3.1-0.3.9...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.6 Plugin Catalog GA plugins release.

Red Hat Developer Hub 1.10.6 Plugin Catalog GA plugins release. Red Hat Developer Hub RHDH is extensible by the plugins included herein...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-97687, CVE-2026-97688, CVE-2026-97689)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-97687 DESCRIPTION: urllib3 is an HTTP client...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-80179, CVE-2026-84185, CVE-2026-92091)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-80179 DESCRIPTION: A flaw was found in jwcrypto...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-84185)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-84185 DESCRIPTION: A flaw was found in the...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-80179)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-80179 DESCRIPTION: A flaw was found in jwcrypto...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-59890)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-59890 DESCRIPTION: setuptools is a package that...

htb-makesense-poc

HTB · MakeSense — PoC Proof-of-concept per la macchina Make...

CVE-2020-3996 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-alicloud, velero-plugin-for-alicloud-fips...

CVE-2026-85683

The Jane Menu WordPress plugin, in versions prior to 1.5.1 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is a lack of capability or nonce checks on a form handler accessible by unauthenticated users, which allows them to bind any published page to a remote ...

CVE-2026-85683 Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL

The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its...

WordPress Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More plugin <= 1.5.17 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Alex Thomas, Wordfence Argus in WordPress Plugin Duplicator versions = 1.5.17...

CVE-2026-86611

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its...

CVE-2026-87837

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...

CVE-2026-87838

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

CVE-2026-111947

The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to...

CVE-2026-110514

The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into portfolio items, removing them from their...