398483 matches found
CVE-2026-76648 Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery
CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...
CVE-2026-92692 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
CVE-2026-77423 JLine: ReDoS in Built-in Less Viewer Search
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...
CVE-2026-95604 WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CVE-2026-95602 WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...
CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
CVE-2026-95601 WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...
CVE-2026-95600 WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...
CVE-2026-95592 WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Team = 6.0.0 versions...
CVE-2026-95593 WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability
Editor SQL Injection in Ultimeter = 3.0.8 versions...
CVE-2026-95590 WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability
Subscriber SQL Injection in Tainacan = 1.2.0 versions...
CVE-2026-95586 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...
CVE-2026-95529 WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...
CVE-2026-95530 WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...
CVE-2026-95528 WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
CVE-2026-95527 WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
CVE-2026-95525 WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
CVE-2026-95523 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95524 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95522 WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...
CVE-2026-95515 WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
CVE-2026-95513 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...
CVE-2026-95514 WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Netgsm = 2.10.0 versions...
CVE-2026-94684 WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Ocean Extra = 2.6.1 versions...
CVE-2026-94680 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
CVE-2026-94682 WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...
CVE-2026-94679 WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
CVE-2026-94671 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
CVE-2026-94500 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...
CVE-2026-94498 WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in AppMySite = 3.15.4 versions...
CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
CVE-2026-94461 WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...
CVE-2026-94457 WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...
CVE-2026-94391 WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...
CVE-2026-94176 WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.4.1 versions...
CVE-2026-94179 WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button = 2.4.9 versions...
CVE-2026-94174 WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
Administrator SQL Injection in Email Log = 2.63 versions...
CVE-2026-94168 WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...
CVE-2026-94118 WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...
CVE-2026-94124 WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability
Contributor SQL Injection in WP EasyCart = 5.9.4 versions...
CVE-2026-94080 WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...
CVE-2026-94079 WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
CVE-2026-93773 WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability
Contributor SQL Injection in Mollie Forms = 2.11.0 versions...
CVE-2026-93774 WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...
CVE-2026-93772 WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in wpForo Forum = 3.1.5 versions...
CVE-2026-93622 WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPS Limit Login = 1.5.9.3 versions...
CVE-2026-93623 WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...
CVE-2026-93620 WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...
CVE-2026-93618 WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1...