Administrator SQL Injection in WP Maps <= 4.9.9 versions.
CVE-2026-66618
Administrator SQL Injection in WP Maps <= 4.9.9 versions.
2026-09-18 归档
今日共收录 2436 条安全情报，包含 1258 个 CVE，779 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
CVE-2026-66617
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
CVE-2026-66608
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <=
Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.
CVE-2026-66580
Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
CVE-2026-66579
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
CVE-2026-66578
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
CVE-2026-66577
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
CVE-2026-66576
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
CVE-2026-66575
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
CVE-2026-66574
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
CVE-2026-66573
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
CVE-2026-66572
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
CVE-2026-66571
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker can manipulate this predictab...
CVE-2026-14850
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the use
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. T...
CVE-2026-92932
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover pl...
CVE-2026-92921
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivatio
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers ...
CVE-2026-92920
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain a
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deploymen...
CVE-2026-92919
admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON re...
CVE-2026-92918
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events
A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without ...
CVE-2026-92904
A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_