Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 82 available sources using the dropdown above.
| ID | Severity | Description | Published | Updated |
|---|---|---|---|---|
| ghsa-hf6x-3cff-j9f3 |
|
The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that … | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-fpg5-6xvr-fpmx |
|
The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities bef… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-fcp7-pjhr-2vrp |
|
The Export & Import WPBakery Page Builder WordPress plugin through 1.0.2 does not perform any CSRF … | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-c378-rx7g-g777 |
|
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before … | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-9gpw-xjv2-w8fg |
|
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user re… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-97p7-8jv8-2rmm |
|
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAM… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-8hqp-p78r-mqpg |
|
The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fie… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-67xq-jjpf-484h |
|
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify th… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-67c7-wvpf-h5rm |
|
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary use… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-5x9m-f82g-8667 |
|
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-58qj-rr2r-8rmm |
|
The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uplo… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-47hw-65wm-f2jr |
|
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several s… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-3mph-m2wr-4wh3 |
|
The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file p… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-3mjh-xq7h-qg2x |
|
The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email a… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-3m7x-5c7v-q57x |
|
The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verific… | 2026-09-12T06:31:20Z | 2026-09-12T06:31:20Z |
| ghsa-prp4-5w2g-8v2c |
9.9 (3.1)
|
GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 be… | 2026-09-12T03:30:23Z | 2026-09-12T03:30:23Z |
| ghsa-rj44-3777-mh5x |
5.7 (4.0)
|
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a … | 2026-09-11T18:31:27Z | 2026-09-12T03:30:22Z |
| ghsa-qh75-x5jv-g7wg |
4.0 (3.1)
6.3 (4.0)
|
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing at… | 2026-09-12T03:30:22Z | 2026-09-12T03:30:22Z |
| ghsa-crrq-mjw6-39qp |
5.4 (3.1)
5.1 (4.0)
|
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attribu… | 2026-09-12T03:30:22Z | 2026-09-12T03:30:22Z |
| ghsa-c9pv-p24c-23v6 |
4.3 (3.1)
5.3 (4.0)
|
starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when… | 2026-09-12T03:30:22Z | 2026-09-12T03:30:22Z |
| ghsa-xvc8-c6gw-4q63 |
9.2 (4.0)
|
An example environment-configuration file for a bundled inventory-management component ships with a… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-wv2v-v3c6-8438 |
6.3 (4.0)
|
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabili… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-vfcm-4hjc-64rr |
6.0 (4.0)
|
Requests from the reverse proxy to the identity-provider service for token discovery, introspection… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-r5jf-jfmr-83g3 |
6.9 (4.0)
|
The administrative password is hashed using a comparatively weak, fast algorithm for the credential… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-qfjc-4hpf-mgw2 |
7.6 (4.0)
|
An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authenti… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-q82q-369g-qpv8 |
5.1 (4.0)
|
A file-upload handler redirects the authenticated client's browser to a URL taken directly from tha… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-mpf9-7jmw-7hrh |
6.3 (3.1)
|
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when … | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-jf96-h34q-q5qw |
8.2 (4.0)
|
An example environment-configuration file ships with a fixed, publicly-known secret value used to s… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-ghx9-35h4-8wf6 |
5.3 (4.0)
|
A deployment mode intended to expose only read access to a bundled packet-analysis component's inte… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |
| ghsa-4hj2-h365-qx39 |
8.2 (3.1)
8.8 (4.0)
|
stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multi… | 2026-09-12T00:31:29Z | 2026-09-12T00:31:29Z |