52883 matches found
npm: undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
npm: undici vulnerable to Denial of Service via unhandled error on excessive content-encodings vulnerability discovered by ? in WordPress npm undici versions = 6.23.0, 6.29.1...
npm: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
npm: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser vulnerability discovered by ? in WordPress npm undici versions = 6.5.0, 6.29.1...
npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens vulnerability discovered by ? in WordPress npm undici versions = 7.15.0, 7.30.1...
npm: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
npm: Serialize JavaScript: Cross-site scripting XSS via unescaped /script at the end of a serialized function body vulnerability discovered by ? in WordPress npm serialize-javascript versions 7.1.3...
npm: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
npm: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown vulnerability discovered by ? in WordPress npm multer versions = 2.0.0, 2.5.0...
npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution vulnerability discovered by ? in WordPress npm happy-dom versions = 17.0.0, = 21.0.3...
npm: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
npm: Fallow: A . glob segment let an analyzed repository make Fallow test paths in the parent of the project root vulnerability discovered by ? in WordPress npm fallow versions 3.34.0...
npm: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
npm: Fallow: Jest and Vitest projects entries let an analyzed repository make Fallow read files outside the project root vulnerability discovered by ? in WordPress npm fallow versions = 2.68.0, 3.34.0...
npm: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
npm: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words vulnerability discovered by ? in WordPress npm postal-mime versions = 3.0.0, 4.0.8...
npm: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
npm: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, 10.1.4...
npm: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
npm: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, 10.1.4...
npm: Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
npm: Nodemailer: A "" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, 10.1.4...
npm: fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
npm: fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding vulnerability discovered by ? in WordPress npm fast-uri versions 2.4.8...
npm: fast-uri vulnerable to improper path equivalence in relative reference normalization
npm: fast-uri vulnerable to improper path equivalence in relative reference normalization vulnerability discovered by ? in WordPress npm fast-uri versions 2.4.8...
npm: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
npm: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization vulnerability discovered by ? in WordPress npm fast-uri versions = 2.4.2, 2.4.8...
npm: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
npm: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references vulnerability discovered by ? in WordPress npm fast-uri versions 2.4.8...
npm: odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
npm: odf-kit has HTML injection leading to XSS in odsToHtml via unescaped style attribute values vulnerability discovered by ? in WordPress npm odf-kit versions = 0.9.8, 0.14.2...
npm: Electron: Mitigation for compromised eMudhra intermediate certificates
npm: Electron: Mitigation for compromised eMudhra intermediate certificates vulnerability discovered by ? in WordPress npm electron versions 42.11.16...
npm: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
npm: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body vulnerability discovered by ? in WordPress npm body-parser versions 1.20.9...
npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes vulnerability discovered by ? in WordPress npm obsidian-tc versions = 1.0.1, = 1.31.3...
npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...
npm: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
npm: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...
npm: obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
npm: obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP vulnerability discovered by ? in WordPress npm obsidian-tc versions = 1.13.0, = 1.31.3...
npm: obsidian-tc tokens can access arbitrary configured vaults
npm: obsidian-tc tokens can access arbitrary configured vaults vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...
npm: obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
npm: obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...
npm: obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
npm: obsidian-tc : Symlink read-ACL scope bypass via lexical path checks vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...
WordPress Depicter — Popup & Slider Builder plugin 4.0.5-4.8.1 - Editor+ Arbitrary File Upload vulnerability
Editor+ Arbitrary File Upload vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Depicter Slider versions 4.0.5-4.8.1...
WordPress Otter Blocks plugin < 3.2.8 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Otter - Gutenberg Block versions 3.2.8...
WordPress CleanTalk Anti-Spam – Complete Spam Protection plugin <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions = 6.89.1...
WordPress WebP Express plugin < 0.25.16 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin WebP Express versions 0.25.16...
WordPress Royal MCP plugin < 1.5.7 - Authentication Bypass vulnerability
Authentication Bypass vulnerability discovered by Raphael P. Cigana in WordPress Plugin Royal MCP versions 1.5.7...
WordPress LiteSpeed Cache plugin < 7.9.2 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin LiteSpeed Cache versions 7.9.2...
WordPress LiteSpeed Cache plugin < 7.9.2 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin LiteSpeed Cache versions 7.9.2...
WordPress Advanced Custom Fields: Extended PRO plugin 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover vulnerability
Unauthenticated Non-Administrator Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.7...
WordPress Advanced Custom Fields: Extended plugin 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover vulnerability
Unauthenticated Non-Administrator Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin ACF Extended versions 0.9.2.7...
WordPress Advanced Custom Fields: Extended PRO plugin 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability
Unauthenticated Administrator Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.7...
WordPress Advanced Custom Fields: Extended PRO plugin < 0.9.2.8 - Unauthenticated RCE vulnerability
Unauthenticated RCE vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.8...
WordPress Advanced Custom Fields: Extended plugin < 0.9.2.8 - Unauthenticated RCE vulnerability
Unauthenticated RCE vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.8...
WordPress Advanced Custom Fields: Extended plugin 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability
Unauthenticated Administrator Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.7...
WordPress Music Store – WordPress eCommerce plugin <= 1.4.7 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Quentin VILLAIN in WordPress Plugin Music Store versions = 1.4.7...
WordPress PixelYourSite Pro plugin < 12.6.8 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin PixelYourSite PRO versions 12.6.8...
WordPress PixelYourSite plugin < 11.4.3 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin PixelYourSite – Your smart PIXEL TAG Manager versions 11.4.3...
WordPress HIPAA Forms plugin < 3.3.2 - hipaa_forms+ Privilege Escalation vulnerability
hipaaforms+ Privilege Escalation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin HIPAA FORMS versions 3.3.2...
WordPress Infility Global plugin < 2.16.25 - Unauthenticated Google Translate API Key Update vulnerability
Unauthenticated Google Translate API Key Update vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Infility Global versions 2.16.25...
WordPress Advanced Custom Fields: Extended PRO plugin 0.8.9.4-0.9.2.7 - Contributor+ XSS vulnerability
Contributor+ XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.8.9.4-0.9.2.7...
WordPress Advanced Custom Fields: Extended plugin 0.8.9.4-0.9.2.7 - Contributor+ XSS vulnerability
Contributor+ XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin ACF Extended versions 0.8.9.4-0.9.2.7...
WordPress LiteSpeed Cache plugin < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal vulnerability
Subscriber+ Pinned Administrative Notice Dismissal vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LiteSpeed Cache versions 7.9.2...
WordPress User Profile Builder plugin < 4.0.5 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Jacek Sowiński in WordPress Plugin Profile Builder versions 4.0.5...
WordPress Download Monitor plugin < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization vulnerability
Multisite Subsite Admin+ Incorrect Authorization vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Download Monitor versions 5.3.5...
WordPress Popup Builder plugin < 4.4.6 - Unauthenticated Popup Trashing vulnerability
Unauthenticated Popup Trashing vulnerability discovered by Raphael P. Cigana in WordPress Plugin Popup Builder versions 4.4.6...