265186 matches found
Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS
Multiple cross-site scripting XSS vulnerabilities in Open Bulletin Board OpenBB 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 redirect parameter to member.php, 2 to parameter to myhome.php 3 TID parameter to post.php, or 4 redirect parameter to...
SAP Internet Graphics Server (IGS) - XML External Entity Injection
SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...
WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting
Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 notify or 2 blog parameter. id: CVE-2013-2287 info: name: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting...
Pretty Url <= 1.5.4 - Cross-Site Scripting
Plugin does not sanitize and escape the URL field in the plugin settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2009 info: name: Pretty Url = 1.5.4 -...
Processwire CMS <2.7.1 - Local File Inclusion
Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. id: CVE-2020-27467 info: name: Processwire CMS 2.7.1 - Local File Inclusion author: 0xAkoko severity: high description:...
Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. id: CVE-2017-18496 info: name: Htaccess by BestWebSoft 1.7.6 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. impact: |...
Visual CSS Style Editor < 7.5.4 - Cross-Site Scripting
The plugin does not sanitise and escape the wyppagetype parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24934 info: name: Visual CSS Style Editor 7.5.4 - Cross-Site Scripting author: Splint3r7 severity: medium description: | The...
Revive Adserver 4.2 - Remote Code Execution
Revive Adserver 4.2 is susceptible to remote code execution. An attacker can send a crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. This can be exploited to perform various types of attacks, e.g...
GHSA-48P8-G2FX-3WWM vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, kubeflow-pipelines-driver-fips, kubeflow-pipelines-fips...
CVE-2026-56862 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-securityhub, azurefile-csi, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips, crossplane-provider-aws-dataexchange, dockerize-fips, crossplane-function-patch-and-transform-fips, cert-manager-google-cas-issuer, go-sqlcm...
GO-2026-6218 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-securityhub, azurefile-csi, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips, crossplane-provider-aws-dataexchange, dockerize-fips, crossplane-function-patch-and-transform-fips, cert-manager-google-cas-issuer, go-sqlcm...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-securityhub, azurefile-csi, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips, crossplane-provider-aws-dataexchange, dockerize-fips, crossplane-function-patch-and-transform-fips, cert-manager-google-cas-issuer, go-sqlcm...
GO-2026-6089 vulnerabilities
Vulnerabilities for packages: sonobuoy, crossplane-provider-aws-securityhub, hubble-fips, kapp-controller-fips, nodetaint-fips, spire-controller-manager-fips, crossplane-provider-aws-cloudcontrol, kiali-fips, mailpit, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips,...
CVE-2026-56858 vulnerabilities
Vulnerabilities for packages: ferretdb, cert-manager-webhook-pdns, task, crossplane-provider-azure-authorization, tekton-chains, terraform-docs, terraform-provider-kubernetes, cloud-provider-vsphere, grafana-rollout-operator, kubescape, crossplane-provider-aws-cloudfront, cert-manager,...
DEBIAN-CVE-2026-47191
kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 3, 2026 to August 9, 2026)
Last week, there were 247 vulnerabilities disclosed in 195 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 135 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...
CVE-2026-56859
creationtimestamp| type| source ---|---|--- 2026-08-14 12:01:10+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mt24drpyoo2x...
ROOT-APP-PYPI-CVE-2026-41066 CVE-2026-41066 in lxml - Patched by Root
Root has patched CVE-2026-41066 in the lxml package for Root:PyPI. Multiple fixed versions available...