552 matches found
CVE-2026-65560
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dzeusking in WordPress Plugin WP Job Portal versions = 2.5.6...
SUSE CVE-2026-66064
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Container Release Update
An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...
CLSA-2026-1780534264 TuxCare security update for jspdf (12 CVEs)
TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1...
CLSA-2026-1775003206 TuxCare security update for commons-io:commons-io (1 CVE)
TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.5-tuxcare.2...
CLSA-2025-1764634061 TuxCare security update for commons-io:commons-io (1 CVE)
TuxCare rebuilt commons-io:commons-io to address 1 CVE. Fixed in 2.5-tuxcare.1...
CLEANSTART-2026-NF97709 Security fixes in k8s-sidecar 2.5.4-r0
Package k8s-sidecar version 2.5.4-r0 fixes 2 vulnerabilities: CVE-2026-25645, ghsa-gc5v-m9x4-r6x2...
CLEANSTART-2026-XZ40260 Security fixes in external-secrets-operator 2.5.0-r0
Package external-secrets-operator version 2.5.0-r0 fixes 2 vulnerabilities: CVE-2026-39883, ghsa-hfvc-g4fc-pqhx...
CLEANSTART-2026-ZY62272 Security fixes in opensearch-k8s-operator-fips 2.5.1-r4
Package opensearch-k8s-operator-fips version 2.5.1-r4 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-33814, CVE-2026-33811, CVE-2026-39836...
PT-2026-65834
Name of the Vulnerable Software and Affected Versions AMMOS Instrument Toolkit AIT GUI versions prior to 2.5.1 Description An authentication flaw allows an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. This is possible by calling the...
WordPress Contact Form 7 plugin < 2.5 - Open Redirect vulnerability
Open Redirect vulnerability discovered by Pedro Antunes in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions 2.5...
CVE-2026-10033
The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...
CVE-2026-10033
The CVE concerns the WordPress plugin EventON Action User, affected up to version 2.5.14. The underlying issue is an authorization bypass in an action (evoau_save_capability AJAX action) that allows unauthenticated attackers to grant EventON management capabilities and the upload_files capability...
CVE-2026-65550
Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...
CVE-2026-24552
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...
EUVD-2026-48142
Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...
CVE-2026-65490
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
CVE-2026-24552 WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...