Archive
2 July 2026
Vulnerabilities first published on this day (UTC), newest first.
151 results · Clear filters · Feed
-
High 7.7
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to e…
-
High 7.5
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CO…
-
High 7.5
A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vuln…
-
High 8.7
A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in …
-
High 8.6
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices runn…
-
High 8.8
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection v…
-
High 8.6
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Prot…
-
High 8.6
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Prot…
-
High 7.5
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Ne…
-
High 7.8
CVE-2026-12168
An improper validation vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to escalate privileges to SYSTEM and execute arbitrary code in kernel mode via crafted messages sent through a Minifilter communication port.
-
High 7.8
CVE-2026-12167
The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to access privileged driver functionality via a communication interface that lacks appropriate access restrictions.
-
High 8.7
Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon
In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user,…
-
High 8.7
Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS
In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized …
-
High 8.8
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs und…
-
High 8.0
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning…
-
High 7.5
luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter
luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-l…
-
High 7.1
WordPress Slider Revolution plugin 7.0.0-7.0.16 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.
-
High 8.8
WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.
-
High 8.8
WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.
-
High 8.5
WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability
Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.
-
High 7.1
WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.
-
High 8.8
WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.
-
High 7.1
WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.
-
High 7.1
WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.
-
High 8.5
WordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability
Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.
-
High 8.5
WordPress iNET Webkit plugin 1.2.4 - SQL Injection vulnerability
Contributor SQL Injection in iNET Webkit 1.2.4 versions.
-
High 8.1
WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.
-
High 7.5
WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Shopify <= 1.0.0 versions.
-
High 7.5
WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerability
Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.
-
High 7.1
WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booked <= 3.0.0 versions.
-
High 8.2
WordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.
-
High 8.5
WordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability
Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.
-
High 7.1
WordPress WowAddons plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.
-
High 7.1
WordPress Simple Link Directory plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.
-
High 7.1
WordPress WP Photo Album Plus plugin <= 9.2.02.004 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.
-
High 7.1
WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
-
High 7.1
WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.
-
High 7.1
WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.
-
High 7.1
WordPress perfmatters plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.
-
High 7.1
WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.