Archive
9 September 2026
Vulnerabilities first published on this day (UTC), newest first.
352 results · Clear filters · Feed
-
Medium 6.9
Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connec…
-
Medium 4.6
Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers…
-
Medium 6.1
Improper input validation in wpa_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-b…
-
Medium 5.6
Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to writ…
-
Medium 4.4
Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bo…
-
Medium 4.4
Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bound…
-
Medium 6.9
Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local atta…
-
Medium 6.9
Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows loca…
-
Medium 4.8
Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configura…
-
Medium 5.4
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorize…
-
Medium 6.4
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticat…
-
Medium 5.9
An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST…
-
Medium 4.3
An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds…
-
Medium 4.3
An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for …
-
Medium 6.2
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.D…
-
Medium 6.2
An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and …
-
Medium 5.5
Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affe…
-
Medium 4.8
Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affe…
-
Medium 6.2
Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability ma…
-
Medium 5.3
Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affe…
-
Medium 5.9
Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affe…
-
Medium 6.4
Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This m…
-
Medium 6.6
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers,…
-
Medium 4.9
WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis…
-
Medium 4.9
Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied pa…
-
Medium 6.4
My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. …
-
Medium 6.4
My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes …
-
Medium 6.1
User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter
The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible …
-
Medium 6.1
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it po…
-
Medium 4.3
DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect avail…
-
Medium 4.0
Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect…
-
Medium 6.2
Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability…
-
Medium 6.4
Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting
The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output es…
-
Medium 5.3
Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check()…
-
Medium 5.4
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
-
Medium 6.5
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Tanium Server.
Tanium addressed an information disclosure vulnerability in Tanium Server.
-
Medium 4.3
Tanium addressed an information disclosure vulnerability in Comply.
Tanium addressed an information disclosure vulnerability in Comply.
-
Medium 5.4
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
-
Medium 4.3
Tanium addressed an improper access controls vulnerability in Tanium Server.
Tanium addressed an improper access controls vulnerability in Tanium Server.