Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
CVE-2026-66606
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
2026-08-21 归档
今日共收录 1701 条安全情报，包含 827 个 CVE，444 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
CVE-2026-66605
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
CVE-2026-66604
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
CVE-2026-66601
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
CVE-2026-66598
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
CVE-2026-66597
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
CVE-2026-66595
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
CVE-2026-66594
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
CVE-2026-66590
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
CVE-2026-66586
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
CVE-2026-66582
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
CVE-2026-66581
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
CVE-2026-28150
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
CVE-2025-62307
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability,
Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.
CVE-2025-53999
Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2025-15637
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. ...
CVE-2026-77067
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any addres
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validatio...
CVE-2026-77066
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to ax
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthe...
CVE-2026-77026
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Su
A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Dire...
CVE-2026-73199
A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer derefere