384033 matches found
CVE-2026-16654 Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...
CVE-2026-3129 LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...
CVE-2026-18983 One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpuaactionprocessoptionupdate function. This is due to insufficient file type validation in wphandleupload called without a MIME...
CVE-2026-18978 LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
CVE-2026-82089
The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...
CVE-2026-82082 Green-Computing｜NUMail - OS Command Injection
NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server...
CVE-2026-82081
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...
CVE-2026-15798 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-77365 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...
CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...
CVE-2026-38822
In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...
CVE-2026-38821
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in httpmicrohttpd.c...
CVE-2026-38820
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...
CVE-2026-38819
Multiple memory leaks in openNDS before 11.0.0 allow an unauthenticated attacker on the captive portal network to exhaust all available memory on the device within minutes...
CVE-2026-61802 Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...
CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration
A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...
CVE-2026-78495 Dimension Server-Side Request Forgery via Remote Backup Connection Test
A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
CVE-2026-78195 Dimension Stored XSS via Backup Historical Data Feature
A Cross-Site Scripting XSS vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's browser...
CVE-2026-78612 Dimension SQL Injection in Scheduled Report
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...
CVE-2026-78103 Dimension Log Server Configuration Lock Bypass Vulnerability
WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...
CVE-2026-78610 Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...
CVE-2026-78613 Dimension SQL Injection in Log Viewer
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...
CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings
A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task
A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...
CVE-2026-78617 WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting
WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...
CVE-2026-78615 WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
CVE-2026-13108 Dimension Denial-of-Service
WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service...
CVE-2026-78618 Dimension Business Logic Flaw Allows Chained Backend Object Operations
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request...
CVE-2026-78614 Dimension SQL Injection in Audit Report
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests...
CVE-2026-78499 Dimension SSRF via FTP Server Test Connection
A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
CVE-2026-78500 Dimension Blind SSRF via Database Test Connection Feature
A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
CVE-2026-78174 WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover...
CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...
CVE-2026-78011 Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS)
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...
CVE-2026-19317 Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...
CVE-2026-19315 Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution
A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic...
CVE-2026-19314 Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS)
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...
CVE-2026-13086 Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint
A stack-based buffer overflow in the epm Endpoint Protection Manager service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code...
CVE-2026-78009 Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS)
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...
CVE-2026-78008 Fireware OS Authenticated Buffer Overflow in wgagent
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service DoS condition or potentially execute arbitrary code by sending specially crafted network traffic...
CVE-2026-78010 Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...
CVE-2026-19318 Fireware OS Pre-Authentication Stack Buffer Overflow in iked Allows Remote Code Execution
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic...
CVE-2026-19316 Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service DoS condition in VPN processing by sending specially crafted network traffic...
CVE-2026-19313 Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic...
CVE-2026-61783 Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...
CVE-2026-54084 Wazuh agent enrollment NULL pointer dereference via malformed manager response
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer...