44924 matches found
CVE-2026-54810 WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexi XPay: from n/a through 8.3.1...
CVE-2026-54810 WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexi XPay: from n/a through 8.3.1...
CVE-2026-39576
Unauthenticated PHP Object Injection in SingleMalt = 1.5 versions...
CVE-2025-69111
Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...
CVE-2025-60230
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9...
Authorization Bypass Through User-Controlled Key
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the handling of prompt history operations, including computediff, updatepromptversion, and deletehistoryentry. An attacker can access or delete another user...
WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability
SQL Injection vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.1.13.005...
CVE-2026-54809 WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10...
CVE-2026-55738 Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name field
A stack-based buffer overflow exists in the rawtoheader function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source...
CVE-2026-55738
The CVE covers a stack-based buffer overflow in rxi/microtar 0.1.0 due to using strcpy() on the 100-byte TAR header name and linkname fields in raw_to_header(). The lack of guaranteed null termination allows reading past the 512-byte header and writing past the destination header buffer, causing ...
CVE-2026-9690
Unauthenticated Arbitrary File Download in WP Media folder Addon = 4.0.1 versions...
CVE-2026-54803
Subscriber Privilege Escalation in SMS Alert Order Notifications = 3.9.4 versions...
CVE-2026-54188
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...
CVE-2026-54189
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...
CVE-2026-54194
Contributor PHP Object Injection in Fusion Builder = 3.15.4 versions...
CVE-2026-42385
Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...
CVE-2026-40761
Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...
CVE-2026-40768
Unauthenticated Insecure Direct Object References IDOR in Salon booking system = 10.30.24 versions...