Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,146 results · Clear filters · Feed
-
Medium 6.3
Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server
Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler gr…
-
Medium 6.0
A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an applicatio…
-
Medium 5.1
Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
-
Medium 6.9
Zenitel Connect login allows username enumeration via verbose error responses
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
-
Medium 4.3
Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerabilit…
-
Medium 6.5
In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, ver…
-
Medium 5.5
In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an ups…
-
Medium 5.5
In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by de…
-
Medium 5.7
CCC Attestation SIG attested-tls-poc through commit 731ca82 TOCTOU via Handshake-Only Attestation
CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake re-attestation. Attackers with local access to the attestin…
-
Medium 5.3
WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability
Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.
-
Medium 6.5
WordPress WP Job Portal plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.7.2.
-
Medium 5.3
WordPress Broadcast Live Video plugin <= 7.3.15 - Broken Authentication vulnerability
Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15.
-
Medium 6.5
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.16 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Stored XSS.This issue affects rtMedia for WordPress, BuddyPress and bbPress…
-
Medium 6.5
WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.
-
Medium 6.3
WordPress CleverReach® WP plugin <= 1.5.26 - Broken Access Control vulnerability
Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26.
-
Medium 6.5
WordPress Everest Backup plugin <= 2.3.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15.
-
Medium 5.3
xschem 2.9.9 through 3.4.7 Out-of-Bounds Read via read_xschem_file() Embedded-Symbol Record
xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read_xschem_file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "[" record, causing xsc…
-
Medium 5.3
WordPress Spectra plugin <= 2.20.5 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5.
-
Medium 5.3
WordPress RepairBuddy plugin <= 4.1236 - Broken Access Control vulnerability
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1236.
-
Medium 6.5
WordPress Extension for Leaflet Map plugin <= 6.1.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extension for Leaflet Map: from n/a through 6.1.1.
-
Medium 5.3
WordPress Church Admin plugin <= 5.1.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8.
-
Medium 6.5
WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder…
-
Medium 4.3
WordPress Imagify plugin <= 2.3.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4.
-
Medium 5.3
WordPress Event Tickets plugin <= 5.31.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0.
-
Medium 4.3
WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
-
Medium 6.5
WordPress myCred plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2.
-
Medium 5.3CVE-2026-125440 Public exploit
WordPress s2Member plugin <= 261106 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through 261106.
-
Medium 4.3
WordPress Slim SEO plugin <= 4.11.5 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in eLightUp Slim SEO slim-seo allows Code Injection.This issue affects Slim SEO: from n/a through 4.11.5.
-
Medium 5.3
WordPress MapSVG plugin <= 9.0.4 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through 9.0.4.
-
Medium 6.5
WordPress JetTabs plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5.
-
Medium 5.3
WordPress CURCY plugin <= 2.2.21 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.
-
Medium 6.5
WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8.
-
Medium 5.3
WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.
-
Medium 6.5
WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.
-
Medium 6.5
AI Command Filters On Any Property Bypassing Column Allowlist
In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.
-
Medium 5.3
WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
-
Medium 6.8
Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00…
-
Medium 4.3
Missing authentication for a critical function (CWE-306) in the management service (uavmonitor_usbv1) of the 1300 commu…
-
Medium 5.4CVE-2026-128970 Public exploit
Missing membership acceptance check permits group share-right deletion by invitees in Psono Server
Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership m…
-
Medium 6.5
Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret …