110 matches found
CVE-2026-109193
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-109193 HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-109193 HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-109193
The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.7.32 . The root cause is insufficient input sanitization and output escaping of the parameter (e.g., hp_custom_link). An unauthe...
EUVD-2026-102797
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. hpcustomlink' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-107657
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-96301
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107657
The HivePress WordPress plugin (versions ≤ 1.7.31 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the < parameter. The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scripts. For the vulnerability to be ex...
CVE-2026-107657 HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107657: Improper Neutralization of Input During Web Page Generation
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' ' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The UserAttributeSimilarityValidator incurred significant overhead when evaluating a submitted password that was artificially large relative to the comparison values. In a situation where access to user...
org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...
org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...
org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...
org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...
org.bouncycastle/bcpg-fips: org.bouncycastle/bcpg-jdk15on: org.bouncycastle/bcpg-jdk18on: Bouncy Castle for Java: Denial of Service due to unbounded OpenPGP user-attribute subpacket length
A flaw was found in Bouncy Castle for Java. The software's processing of OpenPGP user-attribute subpackets does not properly limit their length, bounding them only by the Java Virtual Machine JVM maximum memory. A remote attacker could exploit this by sending a specially crafted OpenPGP message,...
CVE-2026-93504
A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...
CVE-2026-93504
SveltyCMS 0.0.6 is affected by an improper access control flaw in the User Attribute Update Endpoint (file src/routes/api/[...path]/+server.ts). The vulnerability is exploitable over the network with low privileges and no user interaction, resulting in low impact to confidentiality, integrity, an...
EUVD-2026-82904
A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...