CVE-2026-57769
Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.
新着セキュリティニュース バックナンバー
直近表示から外れた情報を確認できます。診断結果とは別情報として扱います。
総件数224649件
表示件数50件/ページ
ページ156
CVE-2026-57767
Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.
CVE-2026-57735
Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
CVE-2026-57717
Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.
CVE-2026-57716
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
CVE-2026-57704
Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.
CVE-2026-57703
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
CVE-2026-57701
Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.
CVE-2026-57699
Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.
CVE-2026-57696
Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
CVE-2026-57626
Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0.
CVE-2026-57428
Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.
CVE-2026-57427
Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.
CVE-2026-57425
Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.
CVE-2026-57397
Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.
CVE-2026-57384
Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.
CVE-2026-57374
Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.
CVE-2026-57373
Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.
CVE-2026-57370
Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.9.1 versions.
CVE-2026-57367
Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
CVE-2026-27423
Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.
CVE-2026-27422
Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions.
CVE-2026-27418
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.
CVE-2026-27403
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.
CVE-2026-27399
Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.
CVE-2026-27392
Contributor Broken Access Control in uListing <= 2.2.0 versions.
CVE-2026-27391
Subscriber Broken Access Control in uListing <= 2.2.0 versions.
CVE-2026-27377
Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.
CVE-2026-27372
Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-27355
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVE-2026-27064
Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
CVE-2026-25466
Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.
CVE-2026-25427
Subscriber Broken Access Control in eRoom <= 1.7.1 versions.
CVE-2026-25424
Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.
CVE-2026-25405
Contributor SQL Injection in eRoom <= 1.7.1 versions.
CVE-2026-24639
Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.
CVE-2026-24628
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
CVE-2026-24552
Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.
CVE-2026-24537
Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.
CVE-2025-68081
Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.
CVE-2026-64611
A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.
CVE-2026-16745
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorized access to the Kubernetes API, potentially leading to arbitrary code execution, privilege escalation, or information disclosure.
CVE-2026-65758
Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.
CVE-2026-65757
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
CVE-2026-65756
Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.
CVE-2026-65755
Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.
CVE-2026-65754
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory.
CVE-2026-65713
Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories.
CVE-2026-65712
Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata.
CVE-2026-65431
Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.