Continuous surveillance of newly registered CVE advisories with CVSS threat scores, attack vector metrics, and impacted software libraries.
Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions....
Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions....
Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions....
Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions....
Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions....
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a one-time password to an attacker-control...
Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5....
Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1....
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9....
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0....
Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions....
Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions....
Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions....
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Ref...
The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in a...
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insu...
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each return...
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflectin...
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticat...
Unauthenticated SQL Injection in WP eMember < v10.9.4 versions....
Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions....
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions....
Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions....
Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions....