Tagged “cve.org”
CVEs tagged cve.org, newest first.
46499 CVEsRSS
CVE-2026-94175High· 7.1WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
CVE-2026-105077High· 7.1WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
CVE-2026-7003Medium· 5.3PoCWIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in…
CVE-2026-62303Medium· 5.9Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes.…
CVE-2026-116851High· 7.1WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
CVE-2026-115604Medium· 5.0WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.
CVE-2026-116386Critical· 9.8WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
CVE-2026-114711Medium· 6.5WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.
CVE-2026-116405High· 7.1WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
CVE-2026-115947Medium· 6.5WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
CVE-2026-116847High· 7.1WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.
CVE-2026-116861High· 7.5WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
CVE-2026-116410Medium· 6.5WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.
CVE-2026-118090High· 8.8WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
CVE-2026-116853Medium· 6.5WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
CVE-2026-116862High· 7.5WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
CVE-2026-116854Medium· 6.5WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
CVE-2026-118089High· 7.2WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
CVE-2026-62122Medium· 5.3WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
CVE-2026-62047Medium· 4.3WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
CVE-2026-104674Medium· 4.3WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
CVE-2026-62121Medium· 6.5WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-element…
CVE-2026-62019Medium· 4.3WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.
CVE-2026-114690Medium· 6.2Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to…
CVE-2026-62023Medium· 4.3WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This is…
CVE-2026-119701Medium· 5.3WPGraphQL before 2.24.1 Email Flooding via Aliased sendPasswordResetEmail Mutations
WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood password reset emails by aliasing the sendPasswordResetEmail mutation. Attackers can send one HTTP request with many al…
CVE-2026-119713High· 8.8Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cl…
CVE-2026-119705Medium· 5.3SerpBear before 3.1.1 Missing Authentication via POST /api/notify
SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST …
CVE-2026-119709Medium· 5.8Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs …
CVE-2026-119288High· 7.0Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quo…