2022

The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could

The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_item

The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before

The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege

The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in po

The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back

The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX action

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortc

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most

The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, a

The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assign

The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update A

The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an

The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, whic

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_

The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which cou

The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow hi

The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which

The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+

The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lsw

The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to downl

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls,

The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the r

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permission

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.

SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to dis

Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.

The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote auth

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.

Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.

An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID a

Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutrali

JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parame

Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-

A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scr

A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers t

There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerabili

The interface of a certain HarmonyOS module has an invalid address access vulnerability. Successful exploitation of this

The interface of a certain HarmonyOS module has a UAF vulnerability. Successful exploitation of this vulnerability may l

Some Huawei products have an integer overflow vulnerability. Successful exploitation of this vulnerability may lead to k

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the smbcd daem

JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.

JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.