CVE Notifier

CVE-2026-18442 CWE-89 7.5

WCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all versions up to, and including, 3.8.2 due to i…

Wordfence wclovers:WCFM · Marketplace · – 3 hari lalu

CVE-2026-17607 CWE-89 6.5

WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including, 2.5.1. This is due to insufficient escapin…

Wordfence chuck1982:WP · Inventory · Manager 3 hari lalu

CVE-2026-17586 CWE-79 6.4

VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitiz…

Wordfence kurudrive:VK · All · in 3 hari lalu

CVE-2026-93494 CWE-1035 7.5

Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated

A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to a…

cve.org Red · Hat:Red · Hat 3 hari lalu

CVE-2026-89058 CWE-? 7.4

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Crede…

cve.org Red · Hat · Red 3 hari lalu

CVE-2026-89059 CWE-409 7.5

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can se…

cve.org Red · Hat · Red 3 hari lalu

CVE-2024-38639 CWE-287 4.8

QTS

An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system. QTS is not affected. We have already fixed …

cve.org QNAP · Systems · Inc.:QTS 3 hari lalu

CVE-2024-27123 CWE-79 N/A

QcalAgent

A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the …

cve.org QNAP · Systems · Inc.:QcalAgent 3 hari lalu

CVE-2026-92561 CWE-79 6.1

Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escapin…

Wordfence wpdevelop:Booking · Calendar 3 hari lalu

CVE-2026-89330 CWE-79 6.1

EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions…

Wordfence wpdevteam:EmbedPress · – · PDF 3 hari lalu

CVE-2026-89278 CWE-200 5.3

GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enq…

Wordfence john-dagelmore:GPTranslate · – · Multilingual 3 hari lalu

CVE-2026-84909 CWE-79 6.4

Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insuf…

Wordfence smub:Custom · Twitter · Feeds 3 hari lalu