490244 matches found
CVE-2026-84387
A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...
Important: Red Hat Security Advisory: Red Hat Quay 3.9.26
Red Hat Quay 3.9.26 is now available with bug fixes. Quay 3.9.26...
Security Bulletin: IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data
Summary IBM webMethods Integration Server is vulnerable to an XML external entity injection XXE attack when processing XML data. CVE-2026-2310. Vulnerability Details CVEID:CVE-2026-2310 DESCRIPTION: IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when...
WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability
Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...
WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by CidKagenouSama in WordPress Plugin WP Travel versions = 12.0.3...
WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Page Visits Counter Lite versions = 1.2.3...
OPENSUSE-SU-2026:21815-1 Security update for waylyrics
This update for waylyrics fixes the following issues: Changes in waylyrics: - Update to version 0.4.0 CVE-2026-25541 bsc1274106 Added plugin architecture and SakuraLLM translation plugin Added OpenCC support for Simplified/Traditional Chinese Added support for custom CSS themes and style presets...
SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...
DNN - Unrestricted Arbitrary File Upload
DNN formerly DotNetNuke \u003C 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no...
CMP WordPress < 4.0.19 - Broken Access Control
CMP WordPress plugin 4.0.19 contains an arbitrary page layout change caused by insufficient access control in the coming soon page feature, letting unauthenticated users modify the layout, exploit requires no authentication. id: CVE-2022-0188 info: name: CMP WordPress 4.0.19 - Broken Access Contr...
Adobe Commerce - Authentication Bypass
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high...
CVE-2026-81806
Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...
CVE-2026-81790
Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8...
CVE-2026-71376 OS Command Injection Vulnerability in Cosminexus Component Container
OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, fr...
CVE-2026-71376
CVE-2026-71376 is an OS command injection vulnerability in Cosminexus Component Container by Hitachi. The affected versions span a wide range: from 09-00 through 09-00-18 , 09-50 through 09-50-22 , 09-70 before 09-70-28 , 09-80 before 09-80-05 , 09-87 before 09-87-10 , 11-00 before 11-00-13 , 11-...
CVE-2026-81806
CVE-2026-81806 is a Server-Side Request Forgery (SSRF) vulnerability in the WordPress Hide My WP Ghost plugin, affecting versions from unspecified through 7.0.09 . The flaw, disclosed by Patchstack , allows an unauthenticated, remote attacker (no user interaction required) to forge server-side re...
EUVD-2026-72646
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
EUVD-2026-72645
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...