246098 matches found
CVE-2026-78293
Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...
CVE-2026-78261
Unauthenticated Cross Site Scripting XSS in Realtyna Organic IDX plugin = 5.4.1 versions...
CVE-2026-78283
Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...
CVE-2026-78273
Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-74848
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...
CVE-2026-32564
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32566
Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
EUVD-2026-66958
Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users ar...
CVE-2026-75020 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope...
CVE-2026-75020
This LDAP Injection vulnerability in Apache APISIX's ldap-auth plugin (versions 2.11.0 through 3.17.0 ) allows a caller holding valid credentials for one LDAP directory entry to authenticate as a consumer mapped to a different entry, effectively bypassing the plugin's configured scope and enablin...
CVE-2026-75020 Apache APISIX: ldap-auth plugin cross-subtree identity impersonation
Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope...
CVE-2026-81276
CVE-2026-81276 affects the Kali Forms WordPress plugin in versions 2.4.23 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 5.3 (Medium) with an attack vector of network, low complexity, no required privileges, and a low impact on integrity. The issue wa...
CVE-2026-81274
The WordPress Ditty (News Ticker) plugin (versions
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81276 WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...
CVE-2026-81273 WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in FluentBooking Pro = 2.2.4 versions...
CVE-2026-81273
FluentBooking Pro (WordPress plugin, versions