405,220 results · Feed
-
Unscored —
Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images
Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted sizes and counts declared in the serialized input. A small crafted input could make an application allocate an excessive a…
-
Medium 4.8
A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This …
-
High 8.8
WordPress Edwiser Bridge plugin <= 4.3.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request Forgery.This issue affects Edwiser Bridge: from n/a through 4.3.4.
-
Medium 4.3
WordPress VOD Infomaniak plugin <= 1.5.16 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16.
-
Medium 4.3
WordPress PowerPress Podcasting plugin <= 11.18.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.2.
-
Medium 5.3
WordPress PowerPack Addons for Elementor plugin <= 3.1.3 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.
-
Medium 6.5
WordPress SureCart plugin <= 4.12.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.
-
Medium 4.3
WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.
-
Medium 4.3
WordPress Happy Addons for Elementor plugin <= 3.51.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0.
-
Medium 5.3
WordPress Ad Inserter plugin <= 2.8.19 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19.
-
Medium 5.3CVE-2026-125439 Public exploit
WordPress Kit (formerly ConvertKit) plugin <= 3.5.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.5.0.
-
Medium 5.3
WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin w…
-
High 8.8
WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11.
-
Medium 6.5
Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Se…
-
Medium 6.5
WordPress Event post plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Stored XSS.This issue affects Event post: from n/a through 6.1.2.
-
Medium 5.3
Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly …
-
Medium 5.3
Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-…
-
Medium 6.4
Author Image <= 4.9.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticate…
-
High 8.8
The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeo…
-
High 8.8
The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. …
-
Unscored —
Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local users
Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
-
Medium 5.5
Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober
A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can …
-
Medium 5.5
Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value
A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero …
-
Medium 4.3
A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-fr…
-
Medium 5.3
Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip
A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this fla…
-
Critical 10.0
WordPress STAGGS plugin <= 3.3.0 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.
-
High 7.1
WordPress Calculated Fields Form plugin <= 5.5.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Calculated Fields Form calculated-fields-form allows DOM-Based XSS.This issue affects Calculated Fields Form: from n/a through 5.5.2.8.
-
High 7.1
WordPress AI Engine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.1.
-
Critical 9.4
Path traversal in host label synchronization allows code execution on the central site from a remote site
Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code …
-
Unscored —
Apache XML Graphics Batik: Denial of Service via SVG Element Reference Resolution
Uncontrolled Recursion vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
-
Critical 9.4
Arbitrary file write and code execution via crafted Synthetic Monitoring agent data
Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the co…
-
Critical 9.4
Arbitrary file write and code execution via excluded node roles in Kubernetes special agent
Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in th…
-
High 7.6
Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()
A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, tr…
-
High 7.5
Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf
A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could explo…
-
Unscored —
Apache XML Graphics Batik: Harden validation in SAXDocumentFactory
XXE vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
-
Medium 6.5
WordPress Delivery & Pickup Date Time for WooCommerce plugin <= 1.3.90 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRockz Delivery & Pickup Date Time for WooCommerce woo-delivery allows Stored XSS.This issue affects Delivery & Pickup Date Time for WooCommerce: …
-
Medium 6.5
WordPress BP Better Messages plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows Stored XSS.This issue affects BP Better Messages: from n/a through 3.2.1.
-
High 7.1
WordPress GeoDirectory plugin <= 2.8.202 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Reflected XSS.This issue affects GeoDirectory: from n/a through 2.8.202.
-
Critical 9.3CVE-2026-112174 Public exploit
Privilege escalation in Enter’s Iperius Backup
Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistent…
-
High 7.5
Busybox: heap buffer overflow in the tftp client on fallback to the default block size
A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standard response, it falls back to the default block size without resizing the allocated memory buffer. A malicious TFTP serv…