Tagged “cve.org”
CVEs tagged cve.org, newest first.
46567 CVEsRSS
CVE-2026-119466Medium· 5.4WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
CVE-2026-85268High· 8.7Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary Java…
CVE-2026-119290High· 7.5Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolv…
CVE-2026-119414Medium· 4.3Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create
Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, w…
CVE-2026-22109High· 8.4Default WebUI passwords stored in plaintext
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
CVE-2026-116366Critical· 9.5PoCUnauthenticated RCE vulnerability against ClickHouse Server
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
CVE-2026-22105High· 8.7Use of default password based on serial number
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, o…
CVE-2026-22114Medium· 5.3Missing brute-force protection for web interface
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
CVE-2026-119561Medium· 6.8phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQ…
CVE-2026-119586High· 7.8SQLite CLI through 3.54.1 Command Injection via .recover Output
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema…
CVE-2026-119565Medium· 4.3Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traf…
CVE-2026-119557Medium· 5.9n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node
n8n from 2.14.0 through 2.46.3 contains a path traversal vulnerability in the Databricks node that allows unauthenticated attackers to reach arbitrary Databricks API endpoints by injecting unencoded resource identifiers. Attackers can su…
CVE-2026-119646Medium· 4.3PoCOpen Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with vie…
CVE-2026-119654High· 8.8PoCDataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can…
CVE-2026-119650Medium· 5.4HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requ…
CVE-2026-119662High· 8.8PoCSongloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend
Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v…
CVE-2026-119658Medium· 4.3PoCPowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attacker…
CVE-2026-119545Medium· 5.3PoCForgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identif…
CVE-2026-119553Medium· 6.5Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can up…
CVE-2026-119549High· 7.1Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images vi…
CVE-2026-61789Medium· 6.1PoCDBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In `src/utils/sql-parser.ts`, `scanSingleLineComment`…
CVE-2026-119418High· 8.1CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through a…
CVE-2026-119426High· 7.5phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into su…
CVE-2026-119422Medium· 5.9Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verify_webhook_source always returns true without…
CVE-2026-119379High· 7.8SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table na…
CVE-2026-118500Medium· 6.4Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7…
CVE-2026-112922Low· 3.3Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation du…
CVE-2026-119378Medium· 5.5SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_no…
CVE-2026-97645High· 7.2Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthe…
CVE-2026-119374High· 7.8SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted F…