21453 matches found
CVE-2026-68565
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-66645
Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...
EUVD-2026-60921
Contributor Cross Site Scripting XSS in Wise Chat = 3.4 versions...
PT-2026-77122
Name of the Vulnerable Software and Affected Versions Charitable versions prior to 1.8.11.4 Description An unauthenticated broken access control issue exists, allowing network exploitation without requiring user interaction. Recommendations Update to a version newer than 1.8.11.3...
PT-2026-77120
Name of the Vulnerable Software and Affected Versions Restaurant Menu by MotoPress versions prior to 2.4.12 Description An unauthenticated Local File Inclusion LFI exists, which allows a remote attacker to read files from the server without requiring user interaction. Local File Inclusion is a...
EUVD-2026-60200
Dell ObjectScale, versions prior to 4.3.0.1, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution...
BIT-DISCOURSE-2026-72729 Discourse: Stored XSS in discourse-local-dates plugin
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6,...
EUVD-2026-59866
The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...
EUVD-2026-57910
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-66458
Unauthenticated SQL Injection in RealPress = 1.1.2 versions...
EUVD-2026-57962
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
EUVD-2026-57959
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
EUVD-2026-57853
Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...
CVE-2026-14680
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for...
EUVD-2026-57842
Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...
UBUNTU-CVE-2026-19695
Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...
CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality
The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...
