Skip to content
OpenAdvisories

Archive

13 March 2026

Vulnerabilities first published on this day (UTC), newest first.

← February 2026 2026 / March /13 April 2026 →
  1. 121
  2. 2229
  3. 3166
  4. 4214
  5. 5495
  6. 6185
  7. 7112
  8. 881
  9. 9161
  10. 10348
  11. 11342
  12. 12202
  13. 13293
  14. 148
  15. 1569
  16. 16191
  17. 17113
  18. 18196
  19. 19248
  20. 20322
  21. 21162
  22. 2280
  23. 23201
  24. 24254
  25. 25629
  26. 26306
  27. 27242
  28. 2856
  29. 2954
  30. 30143
  31. 31273
All Critical High Medium Low Exploited only Public exploit

293 results · Feed

  • Medium 4.3
    CVE-2026-22215

    wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

    wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationship…

    gVectors Team wpDiscuz
  • Medium 4.4
    CVE-2026-22210

    wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs

    wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records…

    gVectors Team wpDiscuz
  • Medium 5.5
    CVE-2026-22209

    wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag

    wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like </style><script>alert(1)</sc…

    gVectors Team wpDiscuz
  • Low 3.7
    CVE-2026-22204

    wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient

    wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_email cookie. Attackers can craft a malicious cookie value that, when processed thr…

    gVectors Team wpDiscuz
  • Medium 4.9
    CVE-2026-22203

    wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext

    wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret…

    gVectors Team wpDiscuz
  • High 8.1
    CVE-2026-22202

    wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email

    wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomments action U…

    gVectors Team wpDiscuz
  • Medium 5.3
    CVE-2026-22201

    wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()

    wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR header…

    gVectors Team wpDiscuz
  • High 7.5
    CVE-2026-22199

    Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi

    Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in…

    Voltronic Power SNMP Web Pro
  • High 8.1
    CVE-2026-22193

    wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()

    wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, a…

    gVectors Team wpDiscuz
  • Critical 9.9
    CVE-2026-22192

    Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage

    Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authenticati…

    Voltronic Power SNMP Web Pro
  • Medium 5.2
    CVE-2026-22191

    Beghelli Sicuro24 SicuroWeb AngularJS Template Injection

    Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by exploiting improper rendering of untrusted input in AngularJS template contexts. Attackers can inject malicious expressi…

    Beghelli SicuroWeb (Sicuro24)
  • Medium 6.1
    CVE-2026-22183

    wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview

    wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered_html c…

    gVectors Team wpDiscuz
  • High 7.5
    CVE-2026-22182

    wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType

    wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint…

    gVectors Team wpDiscuz