405,825 results · Feed
-
Low 2.4
A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names c…
-
Medium 5.3
A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies do not en…
-
High 8.7
A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder d…
-
Medium 5.9
A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks filena…
-
Medium 5.3
Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a paymen…
-
Medium 5.3
Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to…
-
Critical 10.0CVE-2026-118423 Public exploit
WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
-
Medium 4.8
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbit…
-
Critical 9.1
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part…
-
High 8.0
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capability or a nonce before creating a WordPress role from a name supplied in the request, and store that name without escaping it, allowing any authenticate…
-
High 8.8
MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password…
-
Medium 6.2
Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesCha…
-
Unscored —
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows …
-
Critical 9.1
Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master
A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating …
-
Medium 6.5
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client J…
-
Medium 6.1
Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsing
A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifying that data remains in the buffer, causing out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, …
-
Medium 6.1
Gstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds read
A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or …
-
Medium 5.5
Gstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of service
A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessive memory allocation and denial of service. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, o…
-
Medium 6.5
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove un…
-
Medium 6.4
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modi…
-
Medium 6.5
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An att…
-
Medium 5.4
Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the system issues new tokens with a fresh lifetime based on the requester clients configuration instead of limiting it to the original tokens expiration. This…
-
Medium 6.8
Keycloak-services: keycloak-services: admin api missing audience check
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to c…
-
Medium 4.9
Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints
A flaw was found in the SAML brokering component of Keycloak, an identity and access management solution. The issue occurs when Keycloak acts as an intermediary between an upstream identity provider and downstream services. Keycloak fails to respect specific …
-
Medium 4.2
Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding
A flaw was found in the TokenManager component of Keycloak, an open-source identity and access management solution. The issue occurs during the validation of stateless access tokens when the original user ID no longer exists. Keycloak incorrectly falls back t…
-
Medium 5.3
MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscri…
-
Medium 4.9
PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed po…
-
Low 2.7
PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of tha…
-
Medium 4.3
PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowin…
-
Medium 5.6
AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth Callback
The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert t…
-
Medium 6.8
Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a …
-
High 7.5
Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute na…
-
Critical 9.8CVE-2026-113615 Public exploit
GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and o…
-
High 7.5
Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email
The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the …
-
Medium 6.5
Surfer < 1.8.1.759 - Contributor+ Privilege Escalation via Editor API Key Disclosure
The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-le…
-
Medium 5.3
All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including …
-
High 8.0
All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as l…
-
Medium 6.5
WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
-
High 7.5
iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that…
-
High 8.8
Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take ov…