295355 matches found
CVE-2026-95837
The containerd container runtime (versions 2.1.0 through 2.2.6 and 2.3.0 through 2.3.3 ) is vulnerable to a security context bypass during the CRI CreateContainer checkpoint restore process. The root cause is that the CRIU tool restores the process security state from the checkpoint data instead ...
WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Best Payments Plugin for WP versions = 4.6.27...
WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability
Arbitrary Code Execution vulnerability discovered by Peter Tang in WordPress Plugin MDTF versions = 1.3.9...
CVE-2026-108481 WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0...
WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin Patreon WordPress versions = 1.10.0...
CVE-2026-109320
The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...
CVE-2026-109314
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage exposes the...
CVE-2026-109317
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting...
CVE-2026-109309
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...
WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Broadcast Live Video versions = 7.3.6...
WordPress paymendo plugin <= 1.1 - Subscriber+ SQLi vulnerability
Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin paymendo versions = 1.1...
WordPress Loja Automática plugin <= 1.0.0 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Loja Automática versions = 1.0.0...
WordPress Site Setup Wizard plugin <= 1.5.8 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin Site Setup Wizard versions = 1.5.8...
CVE-2024-28000
LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000 🎤 README Translation English فارسی 📸 Screenshot 💎 Introduction This repository contains a Proof of Concept PoC for a critical privilege escalation vulnerability discovered in the LiteSpeed Cache WordPress plugin. The vulnerability,...
Exploit for CVE-2026-85097
CVE-2026-85097 - Bricksforge Word...
CVE-2026-109321
The grav-plugin-login-oauth plugin (versions before 1.4.3 ) contains a predictable local credentials vulnerability. The flaw stems from the plugin provisioning OAuth accounts as standard Grav users using a deterministic username format (. ) and an unsalted MD5 hash of the provider identifier as t...
CVE-2026-109321
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...
CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...