| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. |
| Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. |
| Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions. |
| Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. |
| Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. |
| Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. |
| Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. |
| Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions. |
| Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. |
| Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in the SMB/CIFS. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service and Remote execution. This is a Critical vulnerability as a remote user could send a specially crafted SMB packet and cause a crash, that is persistent in case automatic restarts are enabled. Additionally, a more sophisticated attacker could use the same vulnerability for Remote Code execution. |
| Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass. |
| Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions. |
| Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions. |
| Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions. |
| Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions. |
| Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions. |
| MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0. |
| authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5. |
