Tagged “cve.org”
CVEs tagged cve.org, newest first.
47132 CVEsRSS
CVE-2026-85899High· 8.1Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
CVE-2026-85330Medium· 4.3Microsoft Edge for Android Security Feature Bypass Vulnerability
Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-88090Medium· 5.4Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-96203High· 8.8Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-96192High· 8.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
CVE-2026-20942Medium· 4.3Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-114148High· 7.8PoCASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
CVE-2026-96199High· 8.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-96198High· 8.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-85897High· 8.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-85890High· 8.8Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-119250High· 7.8A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device.
A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device.
CVE-2026-119249High· 7.5A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device.
A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device.
CVE-2026-27062Medium· 4.3WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5.
CVE-2026-54852Medium· 5.3WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from …
CVE-2026-42691Medium· 5.4WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.
CVE-2026-116387Medium· 5.3WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.
CVE-2026-27063Medium· 5.3WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.
CVE-2026-118091Medium· 5.3WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
CVE-2026-115601Medium· 5.3WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a th…
CVE-2026-42694Medium· 4.3WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.
CVE-2026-109891Medium· 6.4WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
CVE-2026-27394High· 7.1WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.
CVE-2026-54856Critical· 9.8WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
CVE-2026-42701High· 7.2WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
CVE-2026-118085High· 7.1WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.
CVE-2026-54860Critical· 9.8WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
CVE-2026-54857Critical· 9.8WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
CVE-2026-61991Critical· 10.0WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
CVE-2026-54864High· 7.1WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.