49550 matches found
PT-2026-97468
Name of the Vulnerable Software and Affected Versions The Post Grid versions prior to 7.9.6 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to properly sanitize...
Linux Distros Unpatched Vulnerability : CVE-2026-61628
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticat...
PT-2026-97654
Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The Webform module, used for creating forms and processing submissions, contains a flaw in how it handles Remote Post handlers. These handlers send data to external servers via APIs. The modul...
PT-2026-97273
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...
PT-2026-97181
Name of the Vulnerable Software and Affected Versions Post Grid Gutenberg Blocks versions prior to 5.0.41 Description An issue exists where the plugin fails to perform authorization or post-visibility checks on a REST API route. This allows unauthenticated users to disclose the custom field key...
PT-2026-97197
Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11 Description Insufficient access restrictions and missing nonce verification for a post-cloning action allow users with Contributor-level permissions or higher to duplicate arbitrary...
CVE-2026-96455: Missing Authentication for Critical Function
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachymini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsgetappmanager, which just hands back the manager object from applicatio...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Remote Post Handlers send webform data to other servers via APIs. The module does not sufficiently...
CVE-2026-86783: Exposure of Sensitive Information to an Unauthorized Actor
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including...
PT-2026-97198
Name of the Vulnerable Software and Affected Versions WC Fields Factory WordPress plugin versions prior to 4.1.11 Description Insufficient access restrictions on the field-management AJAX action allow authenticated users with Subscriber-level permissions or higher to create, modify, and delete...
PT-2026-97189
Name of the Vulnerable Software and Affected Versions JSM Show Post Metadata WordPress plugin versions prior to 4.9.1 Description Insufficient escaping of a post meta key before it is output into an inline event-handler attribute within an admin-facing meta box allows users with contributor-level...
PT-2026-97278
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Dependsget app manager, which just hands back the manager object from...
PT-2026-105061
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get chunk selector/1 calls binary to atom on the raw client-supplied property from post-auth subscribe and resolve offset spec frames, with no whitelist and no existing guard. An authenticat...
PT-2026-97554
Name of the Vulnerable Software and Affected Versions W4 Post List versions prior to 3.0.6 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false questio...
CVE-2026-94671: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
PT-2026-97523
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.12.0 through 7.2.9 Description An authenticated actor can execute arbitrary operating system commands as the openc3 service user. The issue occurs when the set setting method at the POST /openc3-api/api endpoint is use...
CVE-2026-96826: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6...
CVE-2026-96652: Server-Side Request Forgery (SSRF)
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...
CVE-2026-88997: Improper Neutralization of Input During Web Page Generation
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...