The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value...
CVE-2026-96899
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one o
#severity:medium
共收录 5477 条相关情报。
← 返回所有主题The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube...
CVE-2026-96895
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before output
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform...
CVE-2026-97227
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership chec
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on...
CVE-2026-96897
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and...
CVE-2026-97319
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribu
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not...
CVE-2026-86841
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of u
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or...
CVE-2026-92436
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loa
Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both...
CVE-2026-100863
Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/serv
heym before 0.0.105 fails to apply egress guards to integration services that use credential...
CVE-2026-100861
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowin
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext...
CVE-2026-100862
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0
heym before 0.0.105 does not act on the result of the credential authorization lookup in the...
CVE-2026-100860
heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backen
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability...
CVE-2026-100850
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote pl
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint...
CVE-2026-100854
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derive
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per...
CVE-2026-100837
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's...
CVE-2026-100836
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSO
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown...
CVE-2026-100744
A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Htt
Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in...
CVE-2025-71424
Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and includi
http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses...
CVE-2026-100724
http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0...
CVE-2026-100723
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength ==
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the...
CVE-2025-71422
Contrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume fe