267936 matches found
CVE-2026-12793
JetFormBuilder — Dynamic Blocks Form Builder for WordPress (by Crocoblock/jetmonsters) is vulnerable to unauthenticated privilege escalation in all versions up to and including 3.6.2 . The root cause is that the plugin does not validate that the _jet_engine_booking_form_id parameter refers to a p...
EUVD-2026-80096
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...
CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...
EUVD-2026-80094
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-14349
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.3 . The root cause is a missing permission check on the admin_addcustomer AJAX action in main/function_ajax.php, allowing unauthenticated at...
CLEANSTART-2026-GW77529 Previously, resolving relative paths containing parent directory ('
Multiple security vulnerabilities affect the velero-plugin-for-csi package. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...
CLEANSTART-2026-WA59044 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the velero-plugin-for-csi package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
PT-2026-93301
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...
PT-2026-93282
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...
PT-2026-93276
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...
PT-2026-93277
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...
PT-2026-94050
Name of the Vulnerable Software and Affected Versions Leantime versions prior to 3.9.6 Description An authorization bypass exists in the HTMX plugin install endpoint due to a lack of permission validation. This allows authenticated users with limited roles to install marketplace plugins and...
CVE-2026-88064: Improper Input Validation
Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags,...
CVE-2026-92133: Insufficiently Protected Credentials
Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...
PT-2026-93312
Name of the Vulnerable Software and Affected Versions Rox Appointment Booking WordPress plugin versions prior to 1.2.8 Description The plugin fails to perform authorization checks on endpoints that return booking service and category records. This allows unauthenticated attackers to access and re...
CVE-2026-86823: URL Redirection to Untrusted Site
The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...
PT-2026-93759
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions 1.15.0 through 1.15.4 Description The @backstage/plugin-techdocs-node package insufficiently validates the mkdocs.yml file provided by an authenticated user with permissions to register or...
PT-2026-93423
Name of the Vulnerable Software and Affected Versions Kong SAML plugin affected versions not specified Description An authentication bypass exists in the Kong SAML plugin when the validate assertion signature option is explicitly set to false. In this configuration, the plugin may extract the SAM...
CVE-2026-92129: Protection Mechanism Failure
Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute...
PT-2026-93784
Name of the Vulnerable Software and Affected Versions Jenkins Keycloak Authentication Plugin versions prior to 2.4.2 Description The plugin fails to restrict the redirect URL after the login process. This flaw allows attackers to redirect users to malicious sites, facilitating phishing attacks...