149970 matches found
CVE-2026-18335 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirkidata' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary...
CVE-2026-18335
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress (versions
CVE-2026-12227 Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...
CVE-2026-18335 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirkidata' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary...
EUVD-2026-85839
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...
WordPress Visual Composer Website Builder plugin <= 45.16.0 - Unauthenticated Local File Inclusion vulnerability
Unauthenticated Local File Inclusion vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Visual Composer Website Builder versions = 45.16.0...
CVE-2026-12227: Improper Control of Filename for Include/Require Statement in PHP Program
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the vcv-template parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the...
CVE-2026-18335: Server-Side Request Forgery (SSRF)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirkidata' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary...
PT-2026-97774
Name of the Vulnerable Software and Affected Versions Visual Composer Website Builder versions prior to 45.16.1 Description The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation. Unauthenticated attacker...
CVE-2026-94183
Arc Search for Android versions prior to 1.12.10 are vulnerable to a UI spoofing risk. The application fails to display a fullscreen notification when a webpage enters fullscreen mode while the app is running in the background. A remote attacker can exploit this by using a specially crafted websi...
paperweight v0.7.0
Paperweight website Marketing site for Paperweight. Development Install deps from the repo root, then run Next.js in this package: pnpm -C website install pnpm -C website dev Production build pnpm -C website build pnpm -C website start Environment variables This site has two server-side API route...
EUVD-2026-84298
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...
CVE-2026-16778: Improper Neutralization of Input During Web Page Generation
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...
PT-2026-96661
Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.22 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the dslc module downloads output shortcode content...
webkitgtk: Visiting a website may lead to an app denial-of-service
A flaw was found in WebKitGTK. Visiting a malicious website can cause an application denial of service due to improper state management...
CVE-2026-11757
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...
EUVD-2026-82771
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...
CVE-2026-11757 Reflected XSS in KA Informatics' Bar Association Website
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...
CVE-2026-11757
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the KA Informatics Technologies Ltd. Co. Bar Association Website , caused by improper neutralization of input during web page generation. The affected version range extends through 18/09/2026 . The CVSS 3.1 score is 6.1 (MEDIUM) , wit...
CVE-2026-11757 Reflected XSS in KA Informatics' Bar Association Website
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...