2024

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress

The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘o

The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) plugin for WordPress is vulnerab

The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing c

The Shortcodes AnyWhere plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and i

The WP Users Masquerade plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.

The UserPlus plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check

The UserPlus plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0 due to ins

The WP Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up

The Products, Order & Customers Export for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Script

The Maximum Products per User for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t

The GDPR-Extensions-com – Consent Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File

The Marketing and SEO Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in

The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit

The Elementor Inline SVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all v

The Curator.io: Show all your social media posts in a beautiful feed. plugin for WordPress is vulnerable to Stored Cross

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress

The Easy Social Share Buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add

The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/

execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a c

execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a c

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(s

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to eas

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to byp

Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent

A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary we

An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerabili

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Ju

An Out-of-Bounds Read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS E

An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Network

VMware NSX contains a local privilege escalation vulnerability.  An authenticated malicious actor may exploit this vuln

VMware NSX contains a command injection vulnerability.  A malicious actor with access to the NSX Edge CLI terminal may

VMware NSX contains a content spoofing vulnerability.  An unauthenticated malicious actor may be able to craft a URL an

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive in

Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine lear

ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass a

ampache is a web based audio/video streaming application and file manager. A CSRF attack can be performed in order to de

ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the

IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a var

ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface st

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access adminis

Wasmtime is an open source runtime for WebAssembly. Under certain concurrent event orderings, a `wasmtime::Engine`'s int

Wasmtime is an open source runtime for WebAssembly. Wasmtime's implementation of WebAssembly tail calls combined with st

A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticat

A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated

A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view th

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with W

A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-

A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context