52689 matches found
WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Tipsy versions = 1.6...
WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Wine House versions = 3.20...
WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by johska in WordPress Theme Yacht Rental versions = 2.6...
WordPress Ocean Pro Demos plugin <= 1.5.4 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Alex Thomas, Wordfence Argus in WordPress Plugin Ocean Pro Demos versions = 1.5.4...
WordPress Ocean eComm Treasure Box plugin <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Alex Thomas, Wordfence Argus in WordPress Plugin Ocean eComm Treasure Box versions = 1.8.0...
WordPress Redux Framework plugin <= 4.5.11 - Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation vulnerability
Redux Framework = 4.5.11 – Authenticated Subscriber+ Privilege Escalation vulnerability discovered by shark3y in WordPress Plugin Redux Framework versions = 4.5.11...
WordPress Code Snippets plugin < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite) vulnerability
Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure Multisite vulnerability discovered by Sarthak Saxena in WordPress Plugin Code Snippets versions 3.10.0...
WordPress AWP Classifieds plugin < 4.4.9 - Admin+ Arbitrary File Upload vulnerability
Admin+ Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin AWP Classifieds versions 4.4.9...
WordPress Code Snippets plugin < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation vulnerability
Admin+ Network-Scoped Snippet Activation and Deactivation vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Code Snippets versions 3.10.0...
WordPress SendPress Newsletters plugin <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing vulnerability
Subscriber+ Mailing List Sync and Newsletter Queueing vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin SendPress Newsletters versions = 1.26.1.20...
WordPress SendPress Newsletters plugin <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure vulnerability
Unauthenticated Newsletter Sending Log Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin SendPress Newsletters versions = 1.26.1.20...
WordPress Social Web Suite plugin <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update vulnerability
Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Social Web Suite versions = 4.1.12...
WordPress Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More plugin <= 1.16.1 - Missing Authorization vulnerability
Missing Authorization vulnerability discovered by Paul Serban in WordPress Plugin Envira Photo Gallery versions = 1.16.1...
WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin < 4.1.0 - Authenticated (Admin+) SQL Injection vulnerability
Authenticated Admin+ SQL Injection vulnerability discovered by Joshua Martinelle in WordPress Plugin WP Post Author versions 4.1.0...
WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin < 4.1.0 - Authenticated (Contributor+) SQL Injection vulnerability
Authenticated Contributor+ SQL Injection vulnerability discovered by Joshua Martinelle in WordPress Plugin WP Post Author versions 4.1.0...
NPM: fast-jwt: Verifier cache accepts expired JWTs without iat.
NPM: fast-jwt: Verifier cache accepts expired JWTs without iat. vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.3.3...
NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
NPM: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.3.0...
NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
NPM: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.0, = 6.2.4...
NPM: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
NPM: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation and persists in the verifier cache vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.4...
NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
NPM: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array vulnerability discovered by ? in WordPress Npm fast-jwt versions = 6.2.4...
NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery vulnerability discovered by ? in WordPress Npm fast-jwt versions 6.2.4...
NPM: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
NPM: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure vulnerability discovered by ? in WordPress Npm praisonai versions 1.7.3...
NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop DoS — unreleased regression on master vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...
NPM: music-metadata: Uncontrolled memory allocation in APEv2 parser
NPM: music-metadata: Uncontrolled memory allocation in APEv2 parser vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...
NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
NPM: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.12.3...
NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
NPM: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...
NPM: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
NPM: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NOBACKSLASHESCAPES vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.5...
NPM: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
NPM: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion permitSetMultiParamEntries vulnerability discovered by ? in WordPress Npm mariadb versions = 3.2.0, 3.2.5...
NPM: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
NPM: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.5...
NPM: MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
NPM: MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS vulnerability discovered by ? in WordPress Npm mariadb versions = 3.3.0, 3.5.4...
NPM: music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
NPM: music-metadata: uncatchable process crash parsing a crafted .dsf residual of GHSA-v6c2-xwv6-8xf7 vulnerability discovered by ? in WordPress Npm music-metadata versions = 11.14.0...
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by KevineCharles in WordPress Plugin miniorange otp verification versions = 5.5.7...
WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Elaprendiz1927 in WordPress Plugin Forminator versions = 1.57.3...
NPM: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
NPM: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates vulnerability discovered by ? in WordPress Npm handlebars versions = 4.0.0, = 4.7.9...
NPM: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
NPM: Handlebars: JavaScript Injection via AST Type Confusion in compile bypass of CVE-2026-33937 vulnerability discovered by ? in WordPress Npm handlebars versions = 4.0.0, = 4.7.9...
NPM: Handlebars: JavaScript Injection via Own Property Check Bypass
NPM: Handlebars: JavaScript Injection via Own Property Check Bypass vulnerability discovered by ? in WordPress Npm handlebars versions = 3.0.0, = 4.7.9...
WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Kalles versions = 1.1.7.1...
WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Backhoe versions = 2.0...
NPM: JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
NPM: JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applicationssort vulnerability discovered by ? in WordPress Npm generator-jhipster versions = 7.0.0, 9.4.0...
NPM: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
NPM: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob vulnerability discovered by ? in WordPress Npm generator-jhipster versions 9.4.0...
NPM: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
NPM: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob vulnerability discovered by ? in WordPress Npm react-jhipster versions = 1.0.3...
NPM: msgpack5: Truncated map32 headers throw an unexpected error
NPM: msgpack5: Truncated map32 headers throw an unexpected error vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
NPM: msgpack5: Many buffered values can exhaust the streaming decoder stack
NPM: msgpack5: Many buffered values can exhaust the streaming decoder stack vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
NPM: msgpack5: Reserved byte can cause unbounded stream buffering
NPM: msgpack5: Reserved byte can cause unbounded stream buffering vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
NPM: msgpack5: Partial options disable prototype protection
NPM: msgpack5: Partial options disable prototype protection vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
NPM: msgpack5: Deeply nested input can exhaust the decoder stack
NPM: msgpack5: Deeply nested input can exhaust the decoder stack vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
NPM: msgpack5: Quadratic parsing in the streaming decoder
NPM: msgpack5: Quadratic parsing in the streaming decoder vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...
NPM: msgpack5: Decoding negative int64 values mutates the input buffer
NPM: msgpack5: Decoding negative int64 values mutates the input buffer vulnerability discovered by ? in WordPress Npm msgpack5 versions 6.1.0...