2021

The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before ou

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute

The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrar

The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputt

The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX a

The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX a

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the

The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing us

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating

The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber role

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users

The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which coul

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does

The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, whi

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or es

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which inter

The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or esc

The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which c

The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow

The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, w

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploade

The WP Attachment Export WordPress plugin before 0.2.4 does not have proper access controls, allowing unauthenticated us

The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content s

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize t

An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual

Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit em

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to

An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary cod

An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via

An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via

An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code

An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via th

An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via th

An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code vi

The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows fo

Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers

A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10

A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which

A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before vers

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can deadlock, which may

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel driver, where a vGPU can cause resource

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the g

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can double-free a point

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to