Lucene search
+L

475456 matches found

Debian CVE
Debian CVE
added 2026/08/01 12:22 p.m.10 views

CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

6.3CVSS5.5AI score0.00365EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/08/01 12:22 p.m.9 views

CVE-2026-67330

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

9.9CVSS5.5AI score0.00352EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/01 12:22 p.m.47 views

CVE-2026-67305

FreeRDP Windows client (before 3.29.0) has a heap buffer overflow in the clipboard virtual channel (CLIPRDR_FILE_CONTENTS_RESPONSE PDUs) due to lack of validation of the server-provided size against the destination buffer. A malicious RDP server could send a payload larger than requested, causing...

9.4CVSS6.8AI score0.00489EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/08/01 12:22 p.m.13 views

CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

9.3CVSS5.4AI score0.00166EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/08/01 12:22 p.m.8 views

CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

6.3CVSS5.5AI score0.00365EPSS
SaveExploits0References3Affected Software1
Debian CVE
Debian CVE
added 2026/08/01 12:22 p.m.13 views

CVE-2026-67317

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource...

6.3CVSS5.5AI score0.00359EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/08/01 12:21 p.m.11 views

CVE-2026-10773

The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...

5.4CVSS5.5AI score0.00181EPSS
SaveExploits1References3Affected Software1
NVD
NVD
added 2026/08/01 9:17 a.m.7 views

CVE-2026-18062

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

6.4CVSS0.00206EPSS
SaveExploits0References8
NVD
NVD
added 2026/08/01 9:17 a.m.10 views

CVE-2026-16685

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

6.4CVSS0.00241EPSS
SaveExploits0References10
NVD
NVD
added 2026/08/01 9:17 a.m.10 views

CVE-2026-16684

The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00193EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/01 9:16 a.m.9 views

CVE-2026-15644

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS0.00206EPSS
SaveExploits0References8
NVD
NVD
added 2026/08/01 9:16 a.m.7 views

CVE-2026-15052

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

7.2CVSS0.00241EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/01 8:32 a.m.11 views

EUVD-2026-51794

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsivethumbnailimagemanagement function, which...

6.1CVSS5.8AI score0.00216EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/01 8:32 a.m.13 views

EUVD-2026-51792

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

6.5CVSS5.8AI score0.00281EPSS
SaveExploits0References8
ATTACKERKB
ATTACKERKB
added 2026/08/01 8:32 a.m.10 views

CVE-2026-17571

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possibl...

6.1CVSS5.7AI score0.00211EPSS
SaveExploits0References6
GithubExploit
GithubExploit
added 2026/08/01 8:25 a.m.52 views

Exploit for Authentication Bypass Using an Alternate Path or Channel in Kestra

Kestra Unauthenticated RCE Exploit CVE-2026-53576 !Pyth...

10CVSS6.7AI score0.02186EPSS
SaveExploits3
ATTACKERKB
ATTACKERKB
added 2026/08/01 7:49 a.m.10 views

CVE-2026-17580

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

6.5CVSS5.5AI score0.00314EPSS
SaveExploits0References11
Cvelist
Cvelist
added 2026/08/01 7:49 a.m.40 views

CVE-2026-16091 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipressrank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

6.4CVSS0.00201EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/01 7:49 a.m.12 views

EUVD-2026-51764

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/01 7:49 a.m.31 views

CVE-2026-16091

The CVE-2026-16091 entry concerns the GamiPress WordPress plugin (versions up to 7.9.9.1). It describes a Stored Cross-Site Scripting (XSS) vulnerability in the gamipress_rank shortcode caused by insufficient input sanitization and output escaping. Impact: authenticated attackers with contributor...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References7
Rows per page
Query Builder