21454 matches found
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...
openjdk: Enhance XBM image support (Oracle CPU 2026-07)
A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...
CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
PYSEC-2026-3472 jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used
A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...
openjdk: Enhance Jar file processing (Oracle CPU 2026-07)
A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...
WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by qdtad in WordPress Plugin GamiPress versions = 7.9.7...
CVE-2026-65538
CVE-2026-65538 : WordPress Machete plugin ≤ 5.2 contains a Cross Site Scripting (XSS) vulnerability in the author context. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The provided documents do not specify the exact vulnerable component, explo...
CVE-2026-65518
The CVE concerns the WordPress plugin “Accept Donations with PayPal & Stripe” (v <= 1.5.5) and reports a Cross Site Scripting (XSS) vulnerability. Affected product is the WordPress plugin; vulnerability arises from an XSS issue in versions up to 1.5.5 as described in the CVE records. Public re...
EUVD-2026-48119
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
CVE-2026-65498 WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Complianz = 7.5.0 versions...
EUVD-2026-48094
Author Cross Site Scripting XSS in HashThemes Demo Importer = 1.4.2 versions...
CVE-2026-65480
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1...
EUVD-2026-48085
Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12 versions...
EUVD-2026-48079
Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...
CVE-2026-65465
The CVE-2026-65465 entry concerns a Cross Site Scripting (XSS) vulnerability in WordPress JetElements For Elementor plugin versions <= 2.9.1.1. The CVSSv3.1 score is 6.5 (Medium) with network attack vector, low privileges, user interaction required, and changed scope. Impact is low on confiden...
CVE-2026-59522 WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability
Subscriber Broken Access Control in WP ERP = 1.17.5 versions...
EUVD-2026-48184
Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.34.0 versions...
EUVD-2026-48148
Contributor Broken Access Control in Mediavine Control Panel = 2.10.10 versions...
CVE-2026-25405
CVE-2026-25405 affects the WordPress eRoom plugin (≤ 1.7.1). It is a reported SQL Injection vulnerability. CVSSv3.1: 8.5 (HIGH), NETWORK, LOW privileges, no user interaction, confidentiality impact HIGH, integrity and availability variances (I: NONE, A: LOW), scope changed. Connected documents pr...