Archive
September 2026
Vulnerabilities first published in this month (UTC), newest first.
15,012 results · Feed
-
High 8.5
WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.
-
Medium 5.4
WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
-
High 7.5
WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
-
High 7.2
WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
-
High 8.8
WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
-
High 8.5
WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
-
High 7.5
WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
-
High 7.6
WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
-
High 7.1
WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
-
High 7.1
WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
-
Medium 6.5
WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
-
Medium 6.5CVE-2026-94074 Public exploit
WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
-
High 8.8
WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
-
High 7.2
WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
-
High 7.1
WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
-
High 7.2
WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
-
High 7.2
WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
-
High 7.1
WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
-
High 8.2
WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
-
High 7.1
WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
-
High 7.6
WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
-
Medium 5.4
WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
-
Medium 5.4
WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
-
Medium 6.5
WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.
-
Medium 6.5
WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
-
Medium 6.5
WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
-
High 7.1
WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
-
Low 2.7
WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability
Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.
-
High 7.5
Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes…
-
High 8.3
MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img ele…
-
Medium 6.3
OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible …
-
Medium 4.8
Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. A…
-
Critical 9.2
Authentication Bypass in sogo_yhn
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can su…
-
Critical 9.3
Authentication Bypass in sogo_yhn
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arb…
-
High 7.5
Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it sto…
-
Unscored —
MAX_STREAM_DATA frame can open streams beyond the stream limit
When a MAX_STREAM_DATA frame named a peer-initiated bidirectional stream that was not open yet, `received_max_stream_data` treated the stream, and every lower-numbered stream, as opened without checking the stream ID against the limit advertised to the peer. …
-
Unscored —
Long Retry token can panic or exhaust memory in a QUIC client
A client kept the token from a Retry packet without any length limit and put it into the header of every Initial packet it sent afterwards. Initial datagrams are 1200 bytes. When the token and connection IDs left no room for the minimum payload, `PacketBuilde…
-
Unscored —
Receive loop can spin after a truncated datagram
Some targets read one datagram per `recvmsg` call instead of using `recvmmsg`: Apple platforms without the `fast-apple-datapath` feature, OpenBSD, NetBSD, Solaris and illumos, and from 0.6 also DragonFly BSD, Redox and GNU/Hurd. On these targets the receive l…
-
Critical 9.1
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.…
-
Critical 9.8
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommend…