91232 matches found
CVE-2026-28004: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...
CVE-2026-28173: Missing Authorization
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-28187: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...
CVE-2026-66446: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
CVE-2026-58441: Server-Side Request Forgery (SSRF)
SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...
CVE-2026-16853: Out-of-bounds Read
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...
CVE-2026-42931: Allocation of Resources Without Limits or Throttling
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
CVE-2026-16871: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap buffer overflow...
CVE-2026-58420: Improper Access Control
Local File Inclusion via file:// URI in Migration Restore...
CVE-2026-28161: Incorrect Privilege Assignment
Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...
CVE-2026-24059: Improper Privilege Management
The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...
CVE-2026-58511: Exposure of Sensitive Information to an Unauthorized Actor
Webhook Authorization Header Returned in Plaintext via API...
CVE-2026-28168: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in CubeWP = 1.1.30 versions...
CVE-2026-18086: Out-of-bounds Write
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking...
CVE-2026-66704: Server-Side Request Forgery (SSRF)
Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...
CVE-2025-62318: Cross-Site Request Forgery (CSRF)
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...
CVE-2025-62314: Improper Restriction of Excessive Authentication Attempts
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain condition...
CVE-2026-66655: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...
CVE-2026-13365: Cross-Site Request Forgery (CSRF)
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...