3102426 matches found
CVE-2026-66046 Expat Denial of Service via storeAtts() Quadratic Complexity
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...
CVE-2026-66046
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-75872
In maalfer MailerUp before 1.1.3, the unauthenticated public subscription form interpolates the first_name field unescaped into the double opt-in verification email, letting remote attackers send arbitrary HTML from the form owner's configured sending identity to an attacker-chosen address. The v...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
EUVD-2026-60820
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
EUVD-2026-60789
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73367
The WordPress plugin Easy Google Maps (slug google-maps-easy) is vulnerable to unauthenticated Remote File Inclusion (RFI) in versions prior to 1.14.2 . The flaw allows a network attacker with no authentication to include arbitrary remote files, potentially affecting confidentiality and integrity...
CVE-2026-73367 WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73367 WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73367
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73343
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73343
The WP Compress WordPress plugin (versions before 7.20.01) allows unauthenticated remote attackers to execute arbitrary code, scoring CVSS 10.0 critical (full confidentiality, integrity, availability impact). Patchstack is the CNA; the fix is upgrading to 7.20.01 or later. Exploitation details ar...
EUVD-2026-60774
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
EUVD-2026-60898
Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...
CVE-2026-32444
Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...