Tagged “cve.org”
CVEs tagged cve.org, newest first.
46497 CVEsRSS
CVE-2026-118539Medium· 6.5PoCCommerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
CVE-2026-111578High· 7.5PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note —…
CVE-2026-117656Critical· 9.3Unverified Sign in with Apple callback parameter can override verified ID token claims
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorizati…
CVE-2026-77152Medium· 5.3Field Collection for Drupal 7 access bypass via missing parent entity access check
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity. The access check for field collection items (f…
CVE-2026-63338High· 8.3IXP Manager has Broken Object-Level Authorization
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path i…
CVE-2026-63400Low· 2.3Coop sessions are not invalidated on password reset
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a sessi…
CVE-2026-63399Medium· 6.9PoCCoop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition t…
CVE-2026-61840Low· 2.3Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a `second DNS lookup`. An att…
CVE-2026-107868Medium· 5.3WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
CVE-2026-62162High· 8.2Hydra: Deposit Claim omits Head state-token spending requirement
Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the tra…
CVE-2026-48201High· 7.1WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
CVE-2026-78527High· 8.8WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
CVE-2026-116852Critical· 9.1WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability
Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.
CVE-2026-116401High· 7.5WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
CVE-2026-63344High· 8.6PoCRefitter: C# source injection through OpenAPI content-type map keys
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <…
CVE-2026-118086High· 8.8WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
CVE-2026-62302High· 8.7MyTube: Unauthenticated Media Access via Static Routes Bypassing Login
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMi…
CVE-2026-62298None· 0.0asn1c: ASAN crash with decode of open types
mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.…
CVE-2026-7004Medium· 6.1PoCWIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter t…
CVE-2026-119331High· 7.1Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet or…
CVE-2026-62334High· 8.7OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-contr…
CVE-2026-119336High· 7.8Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pi…
CVE-2026-62254Medium· 5.5LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on…
CVE-2026-61620Critical· 9.8HoneySQL unchecked entity names can lead to SQL injection results
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that fac…
CVE-2026-119339Medium· 5.5Tesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service
Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerial…
CVE-2026-62849Critical· 9.1ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe S…
CVE-2026-62979High· 8.4jack: upstream error responses expose backend and peer credentials
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request …
CVE-2026-62250Medium· 5.5LibreDWG: unbounded allocation in pre-R13 DWG entity decoding
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_pre…
CVE-2026-63224High· 7.2PoCOpenRemote has authenticated SQL injection in crosstab datapoint exports
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and stream…
CVE-2026-62968High· 8.7Dream Displays has command-line argument injection in yt-dlp invocation
Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpr…