23327 matches found
CVE-2026-7706
creationtimestamp| type| source ---|---|--- 2026-05-04 00:35:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkyghutsvc2n...
CVE-2026-44338
creationtimestamp| type| source ---|---|--- 2026-05-03 05:26:18+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6rmh-7xcm-cpxj 2026-05-08 17:47:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleby6owc52o 2026-05-14...
CVE-2026-44336
creationtimestamp| type| source ---|---|--- 2026-05-03 05:26:17+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mqq-jqxf-grvw 2026-05-08 17:37:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlebgbpbtw2v 2026-05-08...
PT-2026-43474
Name of the Vulnerable Software and Affected Versions UTT HiPER 1250GW versions prior to 3.2.7-210907-180535 Description A stack-based buffer overflow exists in the Web Management Interface component. The issue occurs within the strcpy function of the file '/goform/formConfigFastDirectionW' when...
PT-2026-43481
Name of the Vulnerable Software and Affected Versions UTT HiPER 1250GW versions prior to 3.2.7-210907-180535 Description A stack-based buffer overflow exists in the Web Management Interface component. The issue occurs within the strcpy function located in the '/goform/formGroupConfig' endpoint. A...
CVE-2026-44523
creationtimestamp| type| source ---|---|--- 2026-05-02 14:28:40+00:00| published-proof-of-concept| https://github.com/enchant97/note-mark/security/advisories/GHSA-q6mh-rqwh-g786 2026-05-08 04:23:36+00:00| seen| https://bsky.app/profile/cyberlensai.bsky.social/post/3mlcv3efmsz2s 2026-05-17...
CVE-2026-7647
The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...
CVE-2026-7647
The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...
EUVD-2026-26750
The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...
CVE-2026-7647 Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection
The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...
CVE-2026-7647 Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection
The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...
CVE-2026-7647
Profile Builder Pro for WordPress (versions up to 3.14.5) is vulnerable to PHP Object Injection due to maybe_unserialize() on the attacker-controlled 'args' parameter in wppb_request_users_pins_action_callback(). The AJAX handler is registered for both authenticated and unauthenticated requests (...
CVE-2026-7641
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the saveextrauserprofilefields function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site e.g...
CVE-2026-4882
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary...
EUVD-2026-26734
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary...
CVE-2026-4882 User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary...
CVE-2026-4882
The CVE concerns the WordPress plugin “User Registration Advanced Fields” (URAF). Vulnerable code path: URAF_AJAX::method_upload, with missing file type validation, across all versions up to and including 1.6.20. This permits unauthenticated attackers to upload arbitrary files on the affected sit...
CVE-2026-4882
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary...
CVE-2026-4882 User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload
The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAFAJAX::methodupload' function in all versions up to, and including, 1.6.20. This makes it possible for unauthenticated attackers to upload arbitrary...
CVE-2026-7641
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.8 via the saveextrauserprofilefields function. This is due to an incomplete blocklist that correctly restricts capability meta keys for the primary site e.g...