Archive
6 August 2026
Vulnerabilities first published on this day (UTC), newest first.
175 results · Clear filters · Feed
-
Medium 6.5
Authorization Bypass Through User-Controlled Key in eScriptorium
Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part p…
-
Medium 4.3
Missing Authorization in eScriptorium
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity…
-
Medium 5.3
NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection
A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/…
-
Medium 4.8
html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including cr…
-
Medium 5.3
NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection
A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component get_credential_from_user. This manipulation of the argument Descri…
-
Medium 5.9
WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
-
Medium 6.5
WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
-
Medium 5.3
WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.
-
Medium 4.3
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
-
Medium 5.3
WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability
Custom role Broken Access Control in Dokan <= 5.0.10 versions.
-
Medium 6.5
WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability
Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.
-
Medium 4.3
WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability
Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
-
Medium 6.5
WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
-
Medium 6.5
WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
-
Medium 5.3
WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
-
Medium 5.3
WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.
-
Medium 5.3
WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.
-
Medium 4.3
WordPress theme My Login plugin <= 7.1.14 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
-
Medium 4.3
WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.
-
Medium 6.5
WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.
-
Medium 6.5
WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.
-
Medium 6.5
WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.
-
Medium 5.3
WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.
-
Medium 6.5
WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
-
Medium 5.3
WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.
-
Medium 5.3
WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.
-
Medium 5.3
WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.
-
Medium 6.5
WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
-
Medium 5.9
WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
-
Medium 5.3
WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
-
Medium 6.5
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability
Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.
-
Medium 6.5
WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
-
Medium 4.3
RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber t…
-
Medium 5.3
LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection
A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The …
-
Medium 5.9
LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descri…
-
Medium 6.8
Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A rem…
-
Medium 6.3
MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to comman…
-
Medium 6.4
UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to …
-
Medium 6.3
MissionSquad mcp-api dcrClients.ts server-side request forgery
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgradin…
-
Medium 4.3
Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard
OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traff…