48602 matches found
EUVD-2026-36839
Unauthenticated Cross Site Scripting XSS in AutomatorWP = 5.7.2 versions...
EUVD-2026-36836
Subscriber Cross Site Scripting XSS in Modula Image Gallery = 2.14.23 versions...
EUVD-2026-36828
Unauthenticated Cross Site Scripting XSS in Simple Membership = 4.7.2 versions...
CVE-2026-40795
The CVE-2026-40795 entry documents a Broken Access Control issue in the WordPress Amelia plugin, affecting versions <= 2.2. The vulnerability targets subscriber access rights, with the CVSS 3.1 base score of 6.5 (Medium), indicating potential high impact on integrity (I) and no confidentiality...
CVE-2026-40789 WordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Amelia = 2.2 versions...
CVE-2026-40775 WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...
CVE-2026-40762
The WPGraphQL WordPress plugin is affected by an unauthenticated SQL Injection in versions earlier than 2.11.1. The issue originates in WPGraphQL
CVE-2026-39579 WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability
Contributor Privilege Escalation in B Blocks = 2.0.31 versions...
CVE-2026-25425 WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration = 5.1.2 versions...
CVE-2026-25425
CVE-2026-25425 concerns the WordPress plugin User Registration (versions ≤ 5.1.2). The connected sources confirm an Unauthenticated Broken Access Control vulnerability in this plugin, affecting its ability to restrict access to certain functions or data. The CVE entry explicitly lists the issue a...
CVE-2025-68851
CVE-2025-68851 refers to the WordPress Okay Toolkit plugin (<= 2.3) and describes an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was identified by Skalucy. The provided documents do not specify the exact vulnerable input, affected product version(s) be...
CVE-2025-68049
CVE-2025-68049 affects the WordPress bunny.net plugin, version up to 2.3.6, with a Broken Access Control flaw. The CVSS 3.1 base metrics indicate Low impact to confidentiality, integrity, and availability, and a network attack vector with low privileges required and no user interaction. The provi...
EUVD-2026-32915
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes...
CVE-2026-49778
creationtimestamp| type| source ---|---|--- 2026-06-15 19:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3modyoehafq2d 2026-06-15 19:27:41+00:00| seen| https://bsky.app/profile/potato.software/post/3modzcxu4oj2p...
CVE-2026-10725
A flaw was found in Protocol::HTTP2. This vulnerability, known as an HTTP/2 Bomb, allows a remote attacker to send a small HTTP/2 request that can expand into a large amount of server memory. This is due to the inbound HPACK path having no header-list size limit, leading to an unbounded buffer...
CVE-2026-9260
creationtimestamp| type| source ---|---|--- 2026-06-15 19:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98100934 2026-06-16 04:20:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moex3aitgp22...
CVE-2026-9262
creationtimestamp| type| source ---|---|--- 2026-06-15 19:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98100934 2026-06-16 04:31:16+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-canon-eos-utility 2026-06-16 04:41:01+00:00| seen|...
CVE-2026-9261
creationtimestamp| type| source ---|---|--- 2026-06-15 19:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98100934 2026-06-16 04:30:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moexn5vw2m2p 2026-06-16 04:31:16+00:00| seen|...
CVE-2026-8356
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the two-way property binding. An attacker can execute arbitrary JavaScript in the context of the user's browser by supplying crafted input to a sensitive DOM property bound with two-way binding syntax. Note:...