41903 matches found
CVE-2026-12418
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuffilesdata' parameter due to missing validation on a user controll...
CVE-2026-12517
creationtimestamp| type| source ---|---|--- 2026-07-09 08:13:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq76tg4nxx2g 2026-07-09 17:49:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6yw2ove2c...
CVE-2026-12418 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuffilesdata' parameter due to missing validation on a user controll...
CVE-2026-12418
CVE-2026-12418 describes a vulnerability in the WordPress plugin “User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration” (versions up to 4.3.7). An insecure direct object reference exists via the wpuf_files_data parameter due to missing validation on ...
EUVD-2026-42542
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuffilesdata' parameter due to missing validation on a user controll...
CVE-2026-12418
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuffilesdata' parameter due to missing validation on a user controll...
CVE-2026-13253
Affected software. Ultimate Post plugin for WordPress (up to version 5.0.31). Vulnerability. Stored Cross-Site Scripting via the 'moreResultsText' attribute of the ultimate-post/advanced-search block. Root cause. Advanced_Search::content() concatenates the attribute value into an HTML attribute a...
EUVD-2026-42520
The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...
CVE-2026-13253
The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...
CVE-2026-13253 Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute
The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the...
CVE-2026-15134
creationtimestamp| type| source ---|---|--- 2026-07-09 04:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6qs3wdao2q...
CVE-2026-15138
creationtimestamp| type| source ---|---|--- 2026-07-09 03:57:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6qj5hmgs2w...
CVE-2026-15137
creationtimestamp| type| source ---|---|--- 2026-07-09 03:52:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6qa72g7o2k...
CVE-2026-54778
creationtimestamp| type| source ---|---|--- 2026-07-09 01:59:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6jxcxorx2e...
CVE-2026-54781
creationtimestamp| type| source ---|---|--- 2026-07-09 01:40:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6iurvqor2z...
CVE-2017-10678
creationtimestamp| type| source ---|---|--- 2026-07-09 00:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq6fdh2sxx2f...
MAL-2026-10038 Malicious code in antsrcsrctest (npm)
The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....
PT-2026-56921
Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description An authenticated arbitrary file write exists in the legacy web UI program-upload workflow. The application stores an attacker-supplied filename prog file into the Programs.File database field and uses this...
PT-2026-57004
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5 Description Post revisions intended to be hidden from regular users may be leaked through visib...