| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions. |
| Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. |
| Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. |
| Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions. |
| Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. |
| Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. |
| Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. |
| Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. |
| Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions. |
| Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. |
| Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components. |
| Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests. |
| Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in the SMB/CIFS. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service and Remote execution. This is a Critical vulnerability as a remote user could send a specially crafted SMB packet and cause a crash, that is persistent in case automatic restarts are enabled. Additionally, a more sophisticated attacker could use the same vulnerability for Remote Code execution. |
| Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass. |
| A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets. |
| A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure. |
| Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions. |
