412460 matches found
CVE-2026-103324
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated attackers to forge an approved-payment notification and mar...
CVE-2026-104643
The Easy HTTPS Redirection SSL WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a...
CVE-2026-110934
Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...
CVE-2026-11905
The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keysconversionmap' parameter. This makes it possible for authenticated attackers, with contributor-level access a...
CVE-2026-101302
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional...
CVE-2026-101303
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic non-VNET jail can send UDP datagrams to services listening on the host's IPv6 loopback address, bypassing jail networ...
CVE-2026-101304
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
CVE-2026-101306
SCMRIGHTS file descriptor passing did not preserve FDRESOLVEBENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has received a directory file descriptor from another jail can use...
CVE-2025-68403
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
CVE-2025-68404
A time-of-check time-of-use toctou race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.6.4.001 and lat...
CVE-2026-101305
renameat2 did not enforce FDRESOLVEBENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir2. This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process...
CVE-2026-101307
When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the...
CVE-2025-66272
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...
CVE-2025-66275
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...
CVE-2025-29897
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync...
CVE-2025-29895
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4...
CVE-2025-29896
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4...
CVE-2026-86803
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
CVE-2026-88043
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-78087
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...
CVE-2026-78001
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes ...
CVE-2026-18548
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-18557
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-18586
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...
CVE-2026-15180
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...
CVE-2026-17001
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-15090
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'linkurl' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
CVE-2026-17031
The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-110923
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected...
CVE-2026-110926
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths...
CVE-2026-110925
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell...
CVE-2026-76666
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read...
CVE-2026-76667
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read...
CVE-2026-3712
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for...
CVE-2026-76665
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow...
CVE-2026-14572
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-108587
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...
CVE-2026-93483
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker can impersonate any user, including...
CVE-2026-93484
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...
CVE-2026-76664
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations...
CVE-2026-110912
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr and inarpinput sys/netinet/ifether.c do not validate the hardware address length arhln and protocol address length arpln fields of incoming ARP packets. inarpreply then uses these attacker-controlled values as memcpy...
CVE-2026-110911
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders such as findOneByEmail, the query builder's whereproperty, value and whereproperty, operator, value, string/UUID-key lookup paths findByKey, updateByKey, deleteByKey and...
CVE-2026-76662
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS...
CVE-2026-76663
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS...
CVE-2026-110908
Netgate pfSense FRR package pfSense-pkg-frr 2.0.21 and source revision 2.1.21 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression in...
CVE-2026-110909
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...
CVE-2026-110907
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string like node:title or user:name used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit...
CVE-2026-77931
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browsewebpage, searchweb, and torrent metadata parsers, which then get passed to the...