The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is...
CVE-2026-111110
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Si
#advisory
共收录 22969 条相关情报。
← 返回所有主题The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is...
CVE-2026-110253
The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media fi
The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to...
CVE-2026-100316
The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via...
CVE-2026-109983
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' paramete
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
CVE-2026-110384
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fa
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its...
CVE-2026-92431
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowin
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination...
CVE-2026-92432
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, al
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the...
CVE-2026-97314
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its l
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
CVE-2026-96627
## Summary A user holding the delegated `users:update` permission can reset the global administrator's password and take
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
CVE-2026-96628
## Summary Arcane v2.10.2 contains an authorization inconsistency in `AuthMiddleware.managerAuth`. When a request supp
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
CVE-2026-105192
### Summary LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiproce
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
CVE-2026-100349
## Summary `ValidateResponse` panics on a nil pointer when a spec declares a response header with `content` instead of
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
CVE-2026-58494
## Summary Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite tha
lopdf has a stack overflow via deeply nested PDF objects
`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounde
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
CVE-2026-102834
### Summary `IPCameraFrameGrabber` parses the `Content-Length` value from the multipart MJPEG HTTP stream returned by th
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
CVE-2026-96620
The Claude Agent SDK for Python passed the `resume` option to the Claude CLI without validation, allowing a value beginn
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
CVE-2026-62994
### Summary A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configu
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
CVE-2026-76894
## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates
swoosh has email-derived URL path injection in Microsoft Graph endpoint
CVE-2026-54893
### Summary `Swoosh.Adapters.MsGraph` builds its Microsoft Graph API request URL by interpolating the sender's email ad
ClickMigrate has Path Traversal in "revision -m" argument
CVE-2026-68549
### Impact A path traversal vulnerability in the `revision` command allowed a crafted migration name supplied via the `-