2021

The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows un

The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allow

The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make log

The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the

The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result

The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which co

The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before output

The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before

The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting

The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them

The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-S

The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowin

The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them

The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a times

The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a times

The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it i

The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high pri

The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via sho

The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_

The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised

The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitis

The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not san

The Edit domain functionality in the WP Domain Redirect WordPress plugin through 1.0 has an `editid` parameter which is

The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanit

The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised,

The Add new scene functionality in the Responsive 3D Slider WordPress plugin through 1.2 uses an id parameter which is n

The edit functionality in the MicroCopy WordPress plugin through 1.1.0 makes a get request to fetch the related option.

A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or val

arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unpriv

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "

loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IOR

Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations

Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts i

Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificate

A path traversal vulnerability on Pardus Software Center's "extractArchive" function could allow anyone on the same netw

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafte

In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vul

In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is v

seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is

Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.

Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.

setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters

RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB proto

Wasmtime is an open source runtime for WebAssembly & WASI. Wasmtime before version 0.30.0 is affected by a type confusio

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 the

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Ra

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specif

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specif