30986 matches found
EUVD-2026-54148
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...
EUVD-2026-54147
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...
EUVD-2026-54261
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...
EUVD-2026-51620
Contao: Possible path traversal in job download URIs...
CVE-2026-66685
Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...
CVE-2026-66681
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
CVE-2026-66447
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...
CVE-2026-65578
Unauthenticated PHP Object Injection in Agora = 1.9 versions...
CVE-2026-65574
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...
CVE-2026-65560
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
CVE-2026-65520
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-28178
Contributor Cross Site Scripting XSS in Powerkit = 3.1.0 versions...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments
@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...
CVE-2026-66706
CVE-2026-66706 affects the WordPress plugin “Subscribe to Comments” (versions
CVE-2026-66706
Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...
EUVD-2026-53909
Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...
EUVD-2026-53900
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...