Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
337 results · Clear filters · Feed
-
Medium 4.3
WordPress Slim SEO plugin <= 4.11.5 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5.
-
Medium 5.3
WordPress MapSVG plugin <= 9.0.4 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through 9.0.4.
-
Medium 6.5
WordPress JetTabs plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5.
-
Medium 5.3
WordPress CURCY plugin <= 2.2.21 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.
-
Medium 6.5
WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8.
-
Medium 5.3
WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.
-
Medium 6.5
WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.
-
Medium 6.5
AI Command Filters On Any Property Bypassing Column Allowlist
In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.
-
Medium 5.3
WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
-
Medium 6.8
Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00…
-
Medium 4.3
Missing authentication for a critical function (CWE-306) in the management service (uavmonitor_usbv1) of the 1300 commu…
-
Medium 5.4CVE-2026-128970 Public exploit
Missing membership acceptance check permits group share-right deletion by invitees in Psono Server
Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership m…
-
Medium 6.5
Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret …
-
Medium 5.7
The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in subsys/bluetooth/host/c…
-
Medium 6.9
X.Org Server glamor Xv Image Size Integer Overflow
A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data.
-
Medium 4.9
Dell PowerStore contains an authorization bypass vulnerability. An authenticated administrator could exploit this vulne…
-
Medium 5.5
Dell PowerStore contains an insecure-file-permissions vulnerability. A local low-privileged attacker could exploit this…
-
Medium 6.0
NULL pointer dereference when a response fragment is not acknowledged
P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relatio…
-
Medium 6.0
Fragment with another data representation releases an Application Relationship
P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Applic…
-
Medium 6.0
RPC reject, fault and cancel PDUs abort an Application Relationship
P-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU for the session aborts the Application Relationship, without checking that the PDU is the answer to a call of the device or where it comes …
-
Medium 5.5
Incorrect handling of negative returns from ddQueryImageAttributes() when processing XvPutImage requests in X.Org xwayl…
-
Medium 6.5
WordPress Spectra plugin <= 2.20.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5.
-
Medium 5.0
Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existi…
-
Medium 5.3
Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulner…
-
Medium 6.5
WordPress WooCommerce plugin 11.0.0-11.2.2 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.
-
Medium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Tobias WebinarIgnition webinar-ignition allows Exploi…
-
Medium 5.3
WordPress Brizy plugin <= 2.8.25 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25.
-
Medium 6.5
WordPress MapSVG plugin <= 9.0.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4.
-
Medium 6.5
WordPress Royal Elementor Addons plugin <= 1.7.1070 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070.
-
Medium 6.5
WordPress Gutenberg Blocks plugin <= 3.7.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Stored XSS.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
-
Medium 6.5
DoS vulnerability in JBL Flip 4
Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker.
-
Medium 5.3
WordPress Product Feed PRO for WooCommerce plugin <= 13.5.8 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Code Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5…
-
Medium 6.5
WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.24.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation allows Stored XSS.This issue affects YITH WooCommerce Ajax Product Filter: from n/…
-
Medium 5.3
WordPress Spectra plugin <= 2.20.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5.
-
Medium 5.3
WordPress Gutenberg Blocks plugin <= 3.7.6 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
-
Medium 4.6
Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exp…
-
Medium 5.3
WordPress We’re Open! plugin <= 2.8 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8.
-
Medium 6.9
X.Org Server XRes QueryClientIds Request Size Overflow
A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.
-
Medium 6.9
Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload f…
-
Medium 6.1
Zipline before 3.7.12 XSS via url parameter on login page
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that exec…