253339 matches found
CVE-2026-24169
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...
CVE-2026-79717
A server-side request forgery SSRF vulnerability was found in galaxyng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata...
CVE-2026-55624
MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...
400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
On August 11th, 2026, we received a submission for an Unauthenticated Account Takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. This vulnerability makes it possible for unauthenticated attackers to obtain an administrator's password reset...
GO-2026-6250 Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write in github.com/aquasecurity/trivy...
CVE-2026-55624 MintyItanium Lost-Auction takes items like barrier blocks out from search GUI
MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...
EUVD-2026-65513
MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...
CVE-2026-55624 MintyItanium Lost-Auction takes items like barrier blocks out from search GUI
MintyItanium Lost-Auction is an auction plugin for Minecraft. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8, players can take items like barrier blocks or duplicate items from the GUI. Commit 88c920b05042929db334ba06d57f052b42d6b3f8 fixes the issue...
CVE-2026-55624
MintyItanium Lost-Auction is an auction plugin for Minecraft servers. Prior to commit 88c920b05042929db334ba06d57f052b42d6b3f8 , players could take items such as barrier blocks or duplicate items from the search GUI, representing an integrity issue with a CVSS 4.0 base score of 5.3 (Medium) . The...
EUVD-2026-65511
A server-side request forgery SSRF vulnerability was found in galaxyng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata...
CVE-2026-79717
CVE-2026-79717 is a blind SSRF in galaxy_ng , the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address (internal networks, loopback, or cloud metadata endpoints). A background worker fetches that ...
WordPress Drag and Drop Multiple File Upload for WooCommerce plugin < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle vulnerability
Unauthenticated File Deletion via Nonce Oracle vulnerability discovered by RealKingEngine ISAL FRAMEWORK in WordPress Plugin Drag and Drop Multiple File Upload for WooCommerce versions 1.1.8...
WordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000027 - Editor+ Arbitrary File Upload vulnerability
Editor+ Arbitrary File Upload vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Insert or Embed Articulate Content into WordPress versions = 4.3000000027...
WordPress MStore API plugin < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability
Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin MStore API versions 4.21.0...
WordPress Simply Schedule Appointments plugin < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode vulnerability
Contributor+ Sensitive Data Disclosure via Admin Shortcode vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Simply Schedule Appointments versions 1.6.12.11...
WordPress LatePoint plugin < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel vulnerability
Unauthenticated Booking Object Mass Assignment via Public Booking Funnel vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin LatePoint versions 5.6.8...
WordPress Hotel Booking Lite plugin < 6.2.3 - Subscriber+ Customer Data Modification via IDOR vulnerability
Subscriber+ Customer Data Modification via IDOR vulnerability discovered by Haitam Lazaar in WordPress Plugin Hotel Booking Lite versions 6.2.3...
WordPress RealHomes Memberships plugin < 3.1.0 - Subscriber+ Membership Payment Bypass vulnerability
Subscriber+ Membership Payment Bypass vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin RealHomes Memberships versions 3.1.0...
WordPress TaxoPress plugin < 3.51.0 - Contributor+ Private Post Disclosure via IDOR vulnerability
Contributor+ Private Post Disclosure via IDOR vulnerability discovered by Duy Tran in WordPress Plugin TaxoPress versions 3.51.0...
WordPress Subscriptions for WooCommerce plugin < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation vulnerability
Shop Manager+ Arbitrary Plugin Installation vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Subscriptions for WooCommerce versions 2.0.1...