406802 matches found
CVE-2026-76086
The Formie Craft CMS plugin (versions prior to 2.2.23 and 3.1.31 ) contains a vulnerability where the formie/integrations/form-settings control panel action lacks proper permission checks. An authenticated attacker, including low-privileged or front-end users, can reach the IntegrationsController...
CVE-2026-96548
A flaw in sfturing hosp_order (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) involves an issue within the ssm_pro/src/main/resources/jdbc.properties file. This manipulation results in hard-coded credentials that can be accessed via a remote attack vector. While the attack complexity is r...
CVE-2026-96546
A one-byte out-of-bounds heap read flaw exists in the GIMP uncompressed DDS image loader . When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This vulnerability may cause the plug-in to crash if the byt...
CVE-2026-71465
The automation-controller component within the Red Hat Ansible Automation Platform is vulnerable to command-line argument injection via the ad-hoc command limit field. The root cause is that RunAdHocCommand.build_args() appends the limit as a bare positional argument instead of using args.extend(...
CVE-2026-71464
The Red Hat Ansible Automation Platform (specifically the automation-controller ) contains a vulnerability in the LaunchConfigurationBaseSerializer.scm_branch component. The root cause is a missing validate_scm_branch() leading-dash check, which allows Schedule and WFJT Node to accept malicious i...
CVE-2026-71463
The Red Hat Ansible Automation Platform (specifically the automation-controller component) is vulnerable to stack trace disclosure due to a Jinja AST whitelist bypass . The whitelist only inspects static Getattr nodes, allowing dynamic subscripts (e.g., job['job'+'_env']) and conditional gating (...
CVE-2026-96545
An out-of-bounds heap read flaw exists in GIMP's TIM image loader . The issue occurs when a user opens a crafted 4bpp TIM image that triggers promotion to an RGBA layer ; the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can result in co...
CVE-2026-76089
The Formie Craft CMS plugin (versions prior to 2.2.23 and 3.1.31 ) contains a missing authorization vulnerability in the SentNotificationsController::actionGetResendModalContent control panel action. The application fails to perform object-level authorization checks when loading a SentNotificatio...
CVE-2026-82356
Imprivata Enterprise Access Management (EAM) versions 26.2.6 and below lack a supported mechanism to rotate the RSA key pair used to generate the appliance's X.509 certificate . Because the key pair remains static indefinitely, a compromise of the private key—via backup exfiltration, hypervisor s...
CVE-2026-71462
The automation-controller component in Red Hat Ansible Automation Platform (versions 2.5, 2.6, and 2.7) is vulnerable to a filesystem path-existence oracle. The root cause is that StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths via the CUSTOM_VENV_P...
CVE-2026-71461
The Red Hat Ansible Automation Platform 2.7 Container Release is affected by CVE-2026-71461, which involves a verbose internal exception disclosure in the HostList.list() function. The component catches a bare Exception and returns the error string verbatim. An authenticated user can trigger a Dj...
CVE-2026-71460
The Red Hat Ansible Automation Platform (specifically the automation-controller component) is vulnerable to unrestricted subscription and license information disclosure. The /api/v2/config/ endpoint is insufficiently protected by only requiring IsAuthenticated status. Consequently, any authentica...
CVE-2026-76648
The Red Hat Ansible Automation Platform 2.7 (and its automation-controller) is vulnerable to a missing authorization check in the CopyAPIView component (located at awx/awx/api/generics.py:873). While the get() handler performs explicit read permission checks, the post() handler (lines 1001–1010) ...
CVE-2026-92692
The Sulu PHP content management system (affected versions 2.6 and 3.0 prior to 2.6.25 and 3.0.8 ) is vulnerable to an unauthenticated JCR-SQL2 injection . The flaw exists in the Smart Content QueryBuilder at src/Sulu/Component/Content/SmartContent/QueryBuilder.php because category identifiers fro...
CVE-2026-77423
The JLine Java library (versions 3.0.0 to 3.30.15 and 4.3.1 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins...
CVE-2026-95604
The Loops & Logic WordPress plugin is vulnerable to an unauthenticated Broken Access Control flaw in versions
CVE-2026-95602
The YITH WooCommerce Request A Quote WordPress plugin is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions prior to 4.46.1 . The root cause is an Authorization Bypass where incorrectly configured access control security levels allow for exploitation via user-controlled key...
CVE-2026-95603
The Reycob Product Import Export plugin for WordPress, specifically versions
CVE-2026-95601
The Product Filter by WBW WordPress plugin (versions
CVE-2026-95600
The WordPress TrustedLogin Connector plugin (versions
CVE-2026-95593
The Ultimeter WordPress plugin versions
CVE-2026-95592
The WordPress Team plugin (versions
CVE-2026-95590
The Tainacan WordPress plugin (versions
CVE-2026-95586
The Ultimate Addons for Contact Form 7 WordPress plugin (versions
CVE-2026-95529
The Calculated Fields Form plugin for WordPress is vulnerable to an unauthenticated Cross Site Scripting (XSS) flaw in versions
CVE-2026-95530
The PixelYourSite – Your smart PIXEL (TAG) Manager WordPress plugin is vulnerable to a Subscriber Cross Site Scripting (XSS) flaw in versions
CVE-2026-95528
The Core Web Vitals & PageSpeed Booster WordPress plugin, in versions
CVE-2026-95527
The Conekta Payment Gateway WordPress plugin, versions
CVE-2026-95525
The WP User Frontend plugin for WordPress, affecting versions
CVE-2026-95523
The WP User Frontend plugin for WordPress, versions
CVE-2026-95524
The WP User Frontend WordPress plugin, affecting versions
CVE-2026-95522
The Easy Digital Downloads WordPress plugin (versions
CVE-2026-95515
The Ninja Forms WordPress plugin, version 3.15.3 and below , is vulnerable to an unauthenticated Cross Site Scripting (XSS) . This vulnerability allows an attacker to execute malicious scripts in the context of the user's browser. No specific root cause, exploit links, or remediation steps are pr...
CVE-2026-95513
The Online Booking & Scheduling Calendar for WordPress by vcita plugin, affecting versions
CVE-2026-95514
The Netgsm WordPress plugin, affecting versions
CVE-2026-94684
This CVE ID is rejected and does not represent an active vulnerability entry.
CVE-2026-94680
The The Post Grid WordPress plugin, versions
CVE-2026-94682
The Podcast Importer SecondLine plugin for WordPress, in versions
CVE-2026-94679
The Fluent Support WordPress plugin, version 2.3.2 and below , is affected by a Broken Access Control vulnerability. This flaw allows for unauthorized actions within the subscriber context. No specific technical root cause, practical consequences, or remediation steps are provided in the availabl...
CVE-2026-94671
The The Post Grid WordPress plugin, version 7.9.5 and below , is affected by a Contributor Cross Site Scripting (XSS) vulnerability. While the specific root cause and affected functions are not detailed in the provided documents, the vulnerability allows for XSS execution within the context of a ...
CVE-2026-94500
The ElementsKit Elementor addons Lite WordPress plugin is vulnerable to a Contributor Cross Site Scripting (XSS) vulnerability in versions
CVE-2026-94498
The AppMySite WordPress plugin (versions
CVE-2026-94487
The PublishPress Capabilities WordPress plugin, in versions
CVE-2026-94461
The Ditty plugin for WordPress, affecting versions
CVE-2026-94457
The WordPress Captcha Code plugin (versions ≤ 3.32 ) is vulnerable to an unauthenticated bypass vulnerability. While the specific root cause and practical consequences are not detailed in the provided documents, the flaw allows for a bypass of security measures. No specific exploits, mitigation s...
CVE-2026-94391
The Ultimate FAQ WordPress plugin, version 2.4.14 and below , is vulnerable to a Contributor Cross-Site Scripting (XSS) flaw. The vulnerability allows for the execution of malicious scripts within the context of the application. While the CVSSv3.1 score is 6.5 (Medium) , the attack requires low p...
CVE-2026-94176
The Mang Board WP WordPress plugin versions
CVE-2026-94179
The Razorpay Payment Button WordPress plugin versions