295389 matches found
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94276
Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...
CVE-2026-94212
Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...
WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability
WordPress Memberful - Membership Plugin plugin = 1.81.0 - Cross Site Request Forgery CSRF vulnerability discovered by henise in WordPress Plugin Memberful - Membership Plugin versions = 1.81.0...
WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by V1T in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.30...
CVE-2026-94276
Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...
CVE-2026-94276
Apache APISIX versions 3.12.0 through 3.18.0 are vulnerable to an Improper Authentication issue in the openid-connect plugin . When using remote introspection against an authorization server supporting multiple issuers, a token valid for one issuer may be incorrectly accepted on a route restricte...
CVE-2026-94276 Apache APISIX: Openid-connect introspection validation issue
Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...
EUVD-2026-90769
Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...
CVE-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94250
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
EUVD-2026-90767
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94250
Apache APISIX versions 1.3.0 through 3.18.0 are vulnerable to an allocation of resources without limits or throttling flaw within the batch-requests plugin . An unauthenticated caller can trigger an Out of Memory (OOM) condition on a gateway worker by targeting a route where the batch-requests pl...
CVE-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...
CVE-2026-94212
Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...
WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions = 5.16.1...
CVE-2026-64947
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...
WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability
Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...
WordPress Autoptimize plugin <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by lhking in WordPress Plugin Autoptimize versions = 3.1.15.1...
WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by hashiramasenju333 in WordPress Plugin LatePoint versions = 5.7.0...