Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-01-15
CVE-2026-21898 - CryptoLib Plugin
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_AOS_ProcessSecurity function reads memory without valid bounds checking when parsing AOS frame hashes. This issue has been patched in version 1.4.3.
PLUGIN
CryptoLib
CVE-2026-21898
Risk Score
Threat Entry
Updated 2026-01-15
CVE-2026-21897 - CryptoLib Plugin
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, the Crypto_Config_Add_Gvcid_Managed_Parameters function only checks whether gvcid_counter > GVCID_MAN_PARAM_SIZE. As a result, it allows up to the 251st entry, which causes a write past the end of the array, overwriting gvcid_counter located immediately after gvcid_managed_parameters_array[250]. This leads to an out-of-bounds write, and the overwritten gvcid_counter may become an arbitrary value, potentially affecting the…
PLUGIN
CryptoLib
CVE-2026-21897
Risk Score
Threat Entry
Updated 2026-01-22
CVE-2026-22584 - Uni2TS Plugin
Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.
PLUGIN
Uni2TS
CVE-2026-22584
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2026-0830 - Kiro IDE Plugin
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.
PLUGIN
Kiro IDE
CVE-2026-0830
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2026-22196 - GestSup Plugin
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
PLUGIN
GestSup
CVE-2026-22196
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2026-22197 - GestSup Plugin
GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
PLUGIN
GestSup
CVE-2026-22197
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2026-22198 - GestSup Plugin
GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator’s browser session.
PLUGIN
GestSup
CVE-2026-22198
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2026-22194 - GestSup Plugin
GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This can be exploited to create privileged accounts by targeting the administrative user creation endpoint.
PLUGIN
GestSup
CVE-2026-22194
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2026-22195 - GestSup Plugin
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
PLUGIN
GestSup
CVE-2026-22195
Risk Score
Threat Entry
Updated 2026-02-10
CVE-2026-0817 - MediaWiki - CampaignEvents extension Plugin
Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.
PLUGIN
MediaWiki - CampaignEvents extension
CVE-2026-0817
Risk Score
Threat Entry
Updated 2026-01-22
CVE-2026-0803 - Online Course Registration System Plugin
A vulnerability was found in PHPGurukul Online Course Registration System up to 3.1. This affects an unknown part of the file /enroll.php. The manipulation of the argument studentregno/Pincode/session/department/level/course/sem results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
PLUGIN
Online Course Registration System
CVE-2026-0803
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2026-22082 - 300Mbps Wireless Router F3 and N300 Easy Setup Router Plugin
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session ID through its web-based administrative interface. A remote attacker could exploit this vulnerability by intercepting network traffic and capturing the session ID during insecure transmission. Successful exploitation of this vulnerability could allow the attacker to hijack an authenticated session and compromise sensitive configuration information on the targeted device.
PLUGIN
300Mbps Wireless Router F3 and N300 Easy Setup Router
CVE-2026-22082
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2026-22081 - 300Mbps Wireless Router F3 and N300 Easy Setup Router Plugin
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface. A remote at-tacker could exploit this vulnerability by capturing session cookies transmitted over an insecure HTTP connection. Successful exploitation of this vulnerability could allow the attacker to obtain sensitive information and gain unau-thorized access to the targeted device.
PLUGIN
300Mbps Wireless Router F3 and N300 Easy Setup Router
CVE-2026-22081
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-14172 - Change Wp Page Permalinks Plugin
The WP Page Permalink Extension plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.4. This is due to missing authorization checks on the `cwpp_trigger_flush_rewrite_rules` function hooked to `wp_ajax_cwpp_trigger_flush_rewrite_rules`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to flush the site's rewrite rules via the `action` parameter.
PLUGIN
Change Wp Page Permalinks
CVE-2025-14172
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-13967 - Woodpecker For Wordpress Plugin
The Woodpecker for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_name' parameter of the [woodpecker-connector] shortcode in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Woodpecker For Wordpress
CVE-2025-13967
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-13908 - The Tooltip Plugin
The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'the_tooltip' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
The Tooltip
CVE-2025-13908
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-13903 - Pullquote Plugin
The PullQuote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pullquote' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Pullquote
CVE-2025-13903
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-13897 - Wp Client Testimonial Plugin
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aft_testimonial_meta_name' custom field in the Client Information metabox in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected administrative page.
PLUGIN
Wp Client Testimonial
CVE-2025-13897
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-13862 - Menu Card Plugin
The Menu Card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `category` parameter in all versions up to, and including, 0.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Menu Card
CVE-2025-13862
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-13854 - Curved Text Plugin
The Curved Text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'radius' parameter of the arctext shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Curved Text
CVE-2025-13854
Risk Score