381447 matches found
CVE-2026-18275
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...
CVE-2026-18258
Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are...
CVE-2026-18276
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...
CVE-2026-70637
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...
CVE-2026-70646
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, WebhookHandler.feedupdate deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will...
CVE-2026-67261
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...
CVE-2026-66712
Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...
CVE-2026-66711
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
CVE-2026-66710
Unauthenticated Local File Inclusion in e2pdf = 1.32.40 versions...
CVE-2026-66703
Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...
CVE-2026-66708
Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...
CVE-2026-66705
Unauthenticated Cross Site Scripting XSS in Facebook for WordPress = 5.2.1 versions...
CVE-2026-66706
Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...
CVE-2026-66702
Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...
CVE-2026-66707
Unauthenticated Cross Site Scripting XSS in Facebook for WooCommerce = 3.7.5 versions...
CVE-2026-66709
Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...
CVE-2026-66692
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-66694
Unauthenticated Cross Site Scripting XSS in Thrive Architect = 10.9.3.1 versions...
CVE-2026-66690
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...
CVE-2026-66699
Custom role Broken Access Control in Dokan = 5.0.10 versions...
CVE-2026-66688
Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...
CVE-2026-66696
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...
CVE-2026-66695
Unauthenticated Path Traversal in W3 Total Cache = 2.10.2 versions...
CVE-2026-66701
Unauthenticated Broken Access Control in Profile Builder = 3.16.5 versions...
CVE-2026-66686
Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...
CVE-2026-66665
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66678
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field = 6.1.1 versions...
CVE-2026-66684
Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...
CVE-2026-66681
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
CVE-2026-66683
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...
CVE-2026-66685
Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...
CVE-2026-66664
Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.0 versions...
CVE-2026-66662
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps = 3.29.10 versions...
CVE-2026-66440
Unauthenticated Cross Site Scripting XSS in WPIDE – File Manager & Code Editor = 3.5.7 versions...
CVE-2026-66447
Unauthenticated SQL Injection in WordPress File Upload = 5.1.7 versions...
CVE-2026-66457
Unauthenticated Cross Site Scripting XSS in Events Manager = 7.4.1 versions...
CVE-2026-66470
Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...
CVE-2026-66663
Unauthenticated Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-66451
Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...
CVE-2026-66452
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei = 1.0.13 versions...
CVE-2026-65581
Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...
CVE-2026-65579
Unauthenticated PHP Object Injection in Agricola = 1.21.0 versions...
CVE-2026-66439
Unauthenticated Cross Site Scripting XSS in Advanced AJAX Product Filters = 3.2.0.3 versions...
CVE-2026-65575
Unauthenticated PHP Object Injection in Accalia = 1.5.3 versions...
CVE-2026-65576
Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...
CVE-2026-65578
Unauthenticated PHP Object Injection in Agora = 1.9 versions...
CVE-2026-66425
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...
CVE-2026-65577
Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...