559 matches found
CVE-2023-47437
CVE-2023-47437 Pachno Vulnerabilidad de Cross-Site Scripting Almacenado https://vulners.com/cve/CVE-2023-47437 Descripción: Se ha identificado una vulnerabilidad en Pachno que permite a un atacante autenticado ejecutar un ataque de Cross-Site Scripting Almacenado XSS. Formularios vulnerables:...
CVE-2026-81778
CVE-2026-81778 affects the Kalles Addons WordPress plugin in versions 1.0.6 and earlier . The vulnerability is a Cross Site Scripting (XSS) flaw in the plugin's Subscriber functionality. The CVSS v3.1 score is 6.5 (MEDIUM) with a Changed Scope vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L)...
CVE-2026-48082
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...
CVE-2026-48074
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...
EUVD-2026-54155
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...
CVE-2026-48082 OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplification
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, the bootstrap challenge endpoint at /api/tenants/id/appointments/bootstrap-challenge issues a SHA-256 proof-of-work with difficulty=4 hex zeros, equivalent to 16 bit...
CVE-2026-48082
OpenReception’s OpenReception appointment-booking software before v1.0.6 uses a bootstrap-challenge PoW endpoint (/api/tenants/{id}/appointments/bootstrap-challenge) that requires SHA-256 with difficulty=4 hex zeros (≈16 bits). Modern hardware solves this quickly, undermining rate-limiting for un...
CVE-2026-48074 OpenReception: Staff deletion removes pending invites cross-tenant by email match
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...
CVE-2026-48074 OpenReception: Staff deletion removes pending invites cross-tenant by email match
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...
EUVD-2026-54258
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANTADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember runs an additional invite cleanup that deletes from the central...
CLSA-2026-1776904637 TuxCare security update for netmask (2 CVEs)
TuxCare rebuilt netmask to address 2 CVEs. Fixed in 1.0.6-tuxcare.1...
CVE-2026-62231 Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...
EUVD-2026-45119
The Grav API plugin getgrav/grav-plugin-api before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created...
PT-2026-60641
Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.6 Description An authorization bypass exists because the ApiKeyAuthenticator class fails to read or enforce the restricted scopes array when API keys are created. Consequently, a key intended for limited...
CVE-2026-59519 WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affects FormLayer: from n/a through 1.0.6...
CVE-2026-59519
CVE-2026-59519 affects the WordPress FormLayer plugin up to version 1.0.6. The issue is described as an insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. Affected component: FormLayer; root cause and exact exploit vector are not elaborated beyond th...
CVE-2026-59519 WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affects FormLayer: from n/a through 1.0.6...
WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FormLayer versions = 1.0.6...
PT-2026-55826
Name of the Vulnerable Software and Affected Versions FormLayer versions prior to 1.0.7 Description An issue in Softaculous FormLayer allows for the insertion of sensitive information into sent data, which can lead to the retrieval of embedded sensitive data. Recommendations Update FormLayer to...
Fedora 44 : thorvg (2026-3d1fcd4ffc)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3d1fcd4ffc advisory. Update to 1.0.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...