Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
CVE-2026-78267
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
#advisory
共收录 23507 条相关情报。
← 返回所有主题Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.
CVE-2026-78264
Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.
Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.
CVE-2026-78259
Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.
Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.
CVE-2026-78266
Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.
CVE-2026-32556
Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice...
CVE-2026-32560
Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versio
Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.
CVE-2026-32561
Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
CVE-2026-78263
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.
Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.
CVE-2026-27364
Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.
vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths
When using the affected versions of the `vibeio-http` crate, an attacker could craft a malicious HTTP/1.x request with a
Cloudreve's remote download file paths can escape the selected destination directory
### Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such a
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
## Summary Cloudreve's file-listing responses hand the client a `context_hint` (UUID) that is meant to speed up follow
A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds...
CVE-2026-7455
A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A
A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an...
CVE-2026-5006
A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().
CVE-2026-75464
OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().
An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip...
CVE-2026-52492
An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory...
CVE-2026-19568
A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A mal
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute...
CVE-2026-52490
An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the proces
A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds...
CVE-2026-16783
A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys...
CVE-2026-78555
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Althoug