Tagged “cve.org”
CVEs tagged cve.org, newest first.
46499 CVEsRSS
CVE-2026-119721Medium· 6.1Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID …
CVE-2026-119762High· 7.5Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authent…
CVE-2026-39375Medium· 5.1Frappe LMS has Stored XSS in Course Meta
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in t…
CVE-2026-119620High· 7.3PoC37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload
A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of t…
CVE-2026-119298Medium· 4.2croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive
croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as…
CVE-2026-104744High· 7.2Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. Thi…
CVE-2026-50000Medium· 5.0SecureDrop: API session token reuse against the Journalist Interface web UI
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `A…
CVE-2026-62056Medium· 5.3WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.
CVE-2026-114691Medium· 5.9Gcc: integer wrap in `std
A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This …
CVE-2026-119979High· 8.8LM Studio before 0.4.22+1 Path Traversal via Model Downloader
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers…
CVE-2026-39739Medium· 6.5WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for …
CVE-2026-61854High· 8.2VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_clea…
CVE-2026-5461Medium· 6.5Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions …
CVE-2026-118194Medium· 6.5Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication
The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-aut…
CVE-2026-118634Medium· 6.4Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possib…
CVE-2026-119059Medium· 4.3Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a stat…
CVE-2025-8574High· 8.7Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for auth…
CVE-2026-89435High· 8.8Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter para…
CVE-2026-119087Medium· 4.3Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is autho…
CVE-2026-90437High· 7.2Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitizatio…
CVE-2026-119148Medium· 6.5Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint
Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-s…
CVE-2026-110732High· 7.5AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration e…
CVE-2026-104623Medium· 6.3PoCAuthorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.1…
CVE-2026-9239Medium· 6.4Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. Thi…
CVE-2026-110001Medium· 5.4FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input saniti…
CVE-2026-119176Medium· 6.4CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This…
CVE-2026-110305High· 7.5Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sens…
CVE-2026-96894High· 7.2ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitizat…
CVE-2026-118635Medium· 6.5GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter
The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.198 This is due to the software allowing …
CVE-2026-97638High· 7.5Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to mi…