6114 matches found
PT-2026-50651
Name of the Vulnerable Software and Affected Versions Fancy Testimonials versions prior to 1.1 Description The Fancy Testimonials plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping within the author attribute o...
DEBIAN-CVE-2026-48990
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...
WordPress Fancy Testimonials plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Fancy Testimonials versions = 1.0...
EUVD-2026-37732
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...
CVE-2026-40733
Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...
CVE-2026-39556
Unauthenticated PHP Object Injection in Konsept = 1.9 versions...
CVE-2025-69166
Unauthenticated Local File Inclusion in Gunslinger = 1.7 versions...
CVE-2025-69157
Unauthenticated Local File Inclusion in Gamic = 1.15 versions...
CVE-2026-39537
Unauthenticated Local File Inclusion in Mikado Core = 1.6 versions...
CVE-2025-69176
Unauthenticated Local File Inclusion in ITactics = 1.0 versions...
CVE-2025-69168
Unauthenticated Local File Inclusion in Spike = 1.2 versions...
CVE-2025-69108
Unauthenticated PHP Object Injection in Hot Coffee = 1.7 versions...
CVE-2025-60230
The CVE-2025-60230 entry details a PHP Object Injection in WordPress The Barber Shop theme (Themeton)
CVE-2025-69170
Technical details such as affected files/versions, root cause, impact, and fixes are not provided in the initial or connected documents; monitor for updates.
CVE-2025-69127 WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...
CVE-2025-69127
CVE-2025-69127 affects the WordPress theme “Plumbing - Plumber and Handyman WordPress Theme” (Plumbing) <= 1.6. Description: Unauthenticated PHP Object Injection in Plumbing <= 1.6. The available document set provides limited public details beyond the vulnerability type and affected version...
CVE-2025-69179 WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Support Ticket Management System = 1.9 versions...
CVE-2025-69179
Technical details (affected plugin version
CVE-2026-48797
Backpropagate is a Python library for fine-tuning LLMs on a single GPU. In versions 1.1.0 and 1.1.1, the Reflex web UI exposes a training control plane without authentication, allowing dataset upload, model load, training control, multi-run orchestration, GGUF export, and HuggingFace Hub push. Th...
CVE-2026-39557
CVE-2026-39557 describes an unauthenticated PHP Object Injection in the WordPress NeoBeat theme, version ≤ 1.7. The underlying issue is a PHP object injection vulnerability in NeoBeat’s code path, enabling unauthenticated attackers to potentially manipulate objects and achieve arbitrary code exec...