11782 matches found
CVE-2026-12570
Removed by vendor...
CVE-2026-19284
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...
CVE-2026-19208
A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FIDJYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is...
WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Mukhlis Amien in WordPress Plugin RealPress versions = 1.1.2...
CVE-2026-11907
The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...
CVE-2026-66710
Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...
CVE-2026-66706
Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...
CVE-2026-66692
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-66688
Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...
CVE-2026-66696
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...
CVE-2026-66683
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...
CVE-2026-65575
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...
CVE-2026-65576
Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...
CVE-2026-65543
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CVE-2026-65515
Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.35.0 versions...
CVE-2026-65513
Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...
CVE-2026-61959
Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...
