295318 matches found
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the currentpageid parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain...
CVE-2026-104799: rnlab Mobile builder: The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,…
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmpprofilesettings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key allow-lis...
CVE-2026-119745: Sender: Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated…
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the adminpostsenderdebugdownload action handled by downloadDebugFile without any capability, nonc...
PT-2026-136971
Name of the Vulnerable Software and Affected Versions Sender plugin for WordPress versions prior to 2.11.3 MultiVendorX plugin for WordPress versions prior to 5.0.21 Description A missing authorization flaw allows any authenticated user, such as those with Subscriber roles, to access a sensitive...
PT-2026-137152
CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16 t message length counters. Attackers can send near-65535-byte data sets and large templates to a...
PT-2026-136928
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the wcfmmp profile settings REST handler exposed at POST /mobile-builder/v1/wcfm-profile-settings. This is due to a PHP loose-comparison logic flaw in the meta key...
gradle-static-analysis-plugin
DEPRECATED Gradle static analysis plugin ⚠️ A fork of this project is maintained at https://github.com/GradleUp/static-analysis-plugin/ Please migrate by using com.gradleup.static-analysis plugin id instead. A Gradle plugin to easily apply the same setup of static analysis tools across different...
HoneyPy
HoneyPy 🍯 A low interaction honeypot with the capability to be more of a medium interaction honeypot. Project status: No longer in active development. Repository will remain for anyone wanting to use or contribute to HoneyPy. I recommend using the honeydb-agent instead:...
CVE-2026-121509
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...
CVE-2026-121509 Headless CMS Plugin REST API post get_required_post_data information disclosure
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...
CVE-2026-121509
The Headless CMS Plugin (up to version 2.0.4 ) for WordPress contains an information disclosure vulnerability in the REST API component. Specifically, the get_required_post_data function within the /wp-json/rae/v1/post endpoint is susceptible to manipulation of the post_id or post_slug arguments....
EUVD-2026-116486
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...
CVE-2026-115715
A flaw was found in Elasticsearch. An authenticated remote user with permissions to write to or search an index utilizing the phonetic analysis plugin can cause a Denial of Service DoS by submitting specially crafted input. Processing this input results in excessive heap memory consumption, causi...
CVE-2026-121548
A flaw was found in nnn. The togglex plugin fails to properly sanitize filenames before passing them to a system command. A local attacker can exploit this flaw by placing a file with a specially crafted name in a directory, leading to arbitrary command execution with the privileges of the user...
CVE-2026-115358
A flaw was found in OpenBao. When processing requests with malformed plugin parameters, such as key-value pair or header fields, error messages containing sensitive input are recorded in audit logs. An authenticated remote attacker can exploit this issue by submitting crafted requests to trigger...
CVE-2026-106557
A flaw was found in @backstage/plugin-techdocs-node. Improper validation of TechDocs Markdown extension configurations allows an authenticated user who can register or modify documentation sources to access resources outside the intended documentation boundary during build operations. This issue...
CVE-2026-106563
A flaw was found in the Backstage Kubernetes backend plugin @backstage/plugin-kubernetes-backend. Due to improper entity validation in a deprecated services endpoint, an authenticated user with read permissions can submit crafted entity data. This issue allows unauthorized information disclosure,...
CVE-2026-115366
A flaw was found in OpenBao. An improper authorization vulnerability in the plugin catalog interface allows an authenticated user with privileged access in a child namespace to modify system-wide plugin configurations. Because access to these endpoints is not restricted to the root namespace, an...
