Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
4,085 results · Clear filters · Feed
-
Medium 4.3
Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and d…
-
Medium 6.5
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student (Subscriber-level) account to disclose the content of …
-
Medium 4.3
Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that performs bulk order-status changes, allowing users with a Dokan vendor account to modify the status of any…
-
Medium 4.1
Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a sui…
-
Medium 4.3
ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approv…
-
Medium 6.1
Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an unauthenticated payment approval request, nor escape it when displaying it in the administration dashboard, allowing unauthenticated attackers to st…
-
Medium 6.1
Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header
The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an u…
-
Medium 4.3
Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR
The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subscriber-level access or above to modify or permanently delete other users' and posts' geolocation rec…
-
Medium 4.9
Import and export users and customers < 2.4.3 - Admin+ Arbitrary File Read
The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server.
-
Medium 6.1
SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass
The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs (such as an Author once granted upload ac…
-
Medium 6.5
Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete…
-
Medium 6.5
Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role…
-
Medium 4.3
GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow
A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipul…
-
Medium 5.4
GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack …
-
Medium 5.3
mz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-bounds
A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mms_mapping/mms_mapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds …
-
Medium 5.5
Gimp: gimp: remote code execution via crafted paa file
A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lzss() function of the PAA file format…
-
Medium 5.5
Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the fi…
-
Medium 5.3
PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)
In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.…
-
Medium 5.3
BCFKS keystore load honours unbounded KDF cost from untrusted file
In Bouncy Castle for Java before 1.85, BCFKS keystore load honours unbounded KDF cost from untrusted file. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2…
-
Medium 6.0
In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local e…
-
Medium 4.4
In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local informatio…
-
Medium 5.5
In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information dis…
-
Medium 4.4
In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of serv…
-
Medium 5.5
In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial…
-
Medium 5.5
In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of se…
-
Medium 4.4
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of servi…
-
Medium 4.4
In display, there is a possible information disclosure due to an integer overflow. This could lead to local information…
-
Medium 4.4
In display, there is a possible information disclosure due to a missing bounds check. This could lead to local informat…
-
Medium 6.7
In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalatio…
-
Medium 6.0
In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Medium 4.4
In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local informat…
-
Medium 6.2
In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local in…
-
Medium 6.5
In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/ad…
-
Medium 6.0
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Medium 6.0
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Medium 5.5
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of…
-
Medium 5.5
In Audio HAL, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local denial of…
-
Medium 6.0
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 5.5
In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of servi…
-
Medium 6.0
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …