The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user...
CVE-2026-85680
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names bef
2026-09-20 归档
今日共收录 942 条安全情报，包含 169 个 CVE，438 篇安全通告，以及 68 篇研究论文。
← 返回归档列表The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several...
CVE-2026-76790
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not...
CVE-2026-19860
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PH
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check...
CVE-2026-85574
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the conf
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its...
CVE-2025-15698
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or...
CVE-2026-84750
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uplo
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an...
CVE-2026-76554
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST...
CVE-2026-88824
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthe
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check...
CVE-2026-16557
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-build
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to...
CVE-2026-89081
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scriptin
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to...
CVE-2026-89333
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Refere
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword...
CVE-2026-92967
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for...
CVE-2026-89334
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to auth
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function...
CVE-2026-92807
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions u
The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...
CVE-2026-12042
The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all v
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
CVE-2026-71537
### Summary The service downgrade implementation in `app/Livewire/Services/Upgrade.php::doUpgrade()` executes a prorati
io.moquette:moquette-broker has a Missing Authorization issue
CVE-2026-85058
## Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testam
Perses's unvalidated project parameter enables filesystem path traversal
CVE-2026-63445
### Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the re
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure
CVE-2026-63199
### Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret na
Perses's project query parameter authorization bypass exposes cross-project resources
CVE-2026-63458
### Impact _What kind of vulnerability is it?_ An authenticated user who is only a viewer on project team-a requests GE