97,116 results · Clear filters · Feed
-
High 7.1
WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
-
High 7.1
WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15.
-
High 7.5
WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.
-
High 7.1
WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review Schema review-schema allows Reflected XSS.This issue affects Review Schema: from n/a through 3.1.4.
-
High 7.5
WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.
-
High 7.1
WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9.
-
High 8.2
Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when …
-
High 8.8CVE-2026-86829 Public exploit
Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the…
-
High 7.3
Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization
Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class named in the serialized Dag, in the scheduler and API server. A Dag author could cause classes within Airflow's deserialization allow list t…
-
High 8.8
Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors
Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a dictionary, but performs that check only after deserializing the whole stored payload. Deserialization reconstructs nested objects of classes pe…
-
High 7.5
Apache Airflow: Logout token revocation fails open; errors silently swallowed
Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during revocation was silently ignored and logout still reported success. When the auth manager redirects logout to an external logout URL (for example the…
-
High 8.6
Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql
Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt w…
-
High 8.2
Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks
Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a `conf` that, once the deadline was missed, either crashed the scheduler …
-
High 8.8
Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API …
-
High 7.3
Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds
A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiat…
-
High 8.1
Missing Authorization in TÜBİTAK BİLGEM's Liderahenk
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse. This issue affects Liderahenk: before 2.0.3.
-
High 7.3
itsourcecode Airline Reservation System manage_flight.php sql injection
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manage_flight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. …
-
High 7.4
aaPanel BillionMail Relay Configuration API relay.go injection
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead …
-
High 7.3CVE-2026-124576 Public exploit
BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number resu…
-
High 7.3
logseq Local HTTP API server.cljs validate-auth-token missing authentication
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from …
-
High 7.5
Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms
The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user.
-
High 7.2
Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions,…
-
High 7.2
Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, i…
-
High 8.8
WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator acc…
-
High 7.5
Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover
The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone…
-
High 7.5
Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login i…
-
High 7.5
Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's passwo…
-
High 8.8
AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an…
-
High 8.8
mView <= 1.0.3 - Subscriber+ Arbitrary File Upload
The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a …
-
High 8.5
Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (ex…
-
High 7.5
D-Link DIR-878 HNAP SetWanSettings buffer overflow
A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The attack may be launch…
-
High 7.5
D-Link DIR-878 HNAP SetWanSettings buffer overflow
A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remot…
-
High 7.5
D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow
A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. The attack can be lau…
-
High 7.3
DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress leads to server-side req…
-
High 7.3
OtterMind Chat2DB Class Generator DbMybatisGenerateServiceImpl.java DbMybatisGenerateServiceImpl.generateClass path traversal
A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName resul…
-
High 7.3
JeecgBoot JimuBI getAllChartData sql injection
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exp…
-
High 7.3
floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal
A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipula…
-
High 7.3
Tidelift moto AWS Batch Emulation models.py privileges management
A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remo…
-
High 8.1
IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication.
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
-
High 7.5
Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.