4925 matches found
CData Sync < 23.4.8843 - Path Traversal
A path traversal vulnerability exists in the Java version of CData Sync CData - Sync' - r...
Post Sync Plugin <= 1.1 - Cross-Site Scripting
Post Sync WordPress plugin = 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a maliciou...
FineCMS <5.0.9 - Open Redirect
FineCMS 5.0.9 contains an open redirect vulnerability via the url parameter in a sync action. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2017-11586 info: name: FineCMS 5.0.9 - Open...
WordPress Videos sync PDF <=1.7.4 - Local File Inclusion
WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion. id: CVE-2022-1392 info: name: WordPress Videos sync PDF =1.7.5 or apply the vendor-provided patch to mitigate the vulnerability. reference...
CVE-2026-67307 Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync
Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...
CVE-2026-67307
Wazuh 5.0.0-beta1 is affected by a vulnerability in inventory-sync Start FlatBuffer messages where cluster_name and cluster_node are not validated or overridden, while agentid is validated. This enables a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerab...
CVE-2026-67307 Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync
Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...
WordPress VR Calendar <=2.3.2 - Remote Code Execution
WordPress VR Calendar plugin through 2.3.2 is susceptible to remote code execution. The plugin allows any user to execute arbitrary PHP functions on the site. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without...
QNAP HBS 3 - Broken Access Control
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 Hybrid Backup Sync. If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to...
CVE-2026-17918
An use after free flaw was found in the Sync component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513127137...
SUSE CVE-2026-17918
Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...
SUSE CVE-2026-52808
Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints - PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync - are gated by reqRepoWriter rather than reqRepoAdmin. The equivalent...
SUSE CVE-2026-54067
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing breaks out of its surrounding tag when renderSnippet interpolates it via insertAdjacentHTML. A payload like runs arbitrary JavaScript in the renderer. On Electron desktop builds the renderer...
CVE-2026-5582
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
EUVD-2026-51096
The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...
CLEANSTART-2026-RJ61585 Security fixes in git-sync 4.5.1-r1
Package git-sync version 4.5.1-r1 fixes 10 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2025-61726, CVE-2025-61728, CVE-2025-68119...
CVE-2026-14923
The CVE-2026-14923 entry applies to the WordPress plugin Sync Post With Other Site, affecting versions before 1.9.3. The issue is an operator-precedence flaw in the REST route’s authorization check, which fails to properly enforce page-editing capability. As a result, an authenticated user with o...
CVE-2026-17918
Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...