Veille CVE

Recherche « Jetpack »

6 CVE

Critique 0 Élevée 0 Moyenne 5 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Jetpack » ✕
  1. CVE-2026-114236 3.3 Faible

    Red Hat Confidential Compute Attestation · Red Hat DPU kit for NVIDIA · Red Hat Exploit Intelligence · Red Hat Multicluster Engine for Kubernetes

    storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

  2. CVE-2026-40808 6.5 Moyenne

    Automattic Jetpack VideoPress

    Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

  3. CVE-2026-106602 4.8 Moyenne

    Automattic Jetpack

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.

  4. CVE-2026-106601 5.4 Moyenne

    Automattic Jetpack

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.

  5. CVE-2026-5191 5.4 Moyenne

    raja3c Tiled Gallery Carousel Without JetPack

    The Tiled Gallery Carousel Without JetPack plugin for WordPress is vulnerable to stored cross-site scripting via the 'data-image-title' parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  6. CVE-2022-50958 6.1 Moyenne

    Jetpack

    WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the post_id parameter. Attackers can craft URLs to the grunion-form-view.php endpoint with script payloads in the post_id parameter to execute arbitrary JavaScript in victim browsers.