VulnSea

Tagged “cve.org”

CVEs tagged cve.org, newest first.

47143 CVEsRSS

CVE-2026-118074High· 7.2
1w ago

WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.

▾ TwilightDaman Jeet · finale-woocommerce-sales-countdown-timer-discountEPSS 0.30%via CVEORG
CVE-2026-116865High· 7.2
1w ago

WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability

Editor PHP Object Injection in Zippy <= 1.7.0 versions.

▾ TwilightGesundheit Bewegt GmbH · zippyEPSS 0.30%via CVEORG
CVE-2026-116869High· 7.2
1w ago

WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

▾ TwilightmyPOS Payments · mypos-virtual-for-woocommerceEPSS 0.30%via CVEORG
CVE-2026-118077High· 7.2
1w ago

WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability

Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

▾ TwilightFast Themes · sastra-essential-addons-for-elementorEPSS 0.30%via CVEORG
CVE-2026-118078High· 7.2
1w ago

WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

▾ TwilightPixelYourSite · product-catalog-feedEPSS 0.30%via CVEORG
CVE-2026-118073High· 8.8
1w ago

WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

▾ Twilightblazethemes · news-kit-elementor-addonsEPSS 0.39%via CVEORG
CVE-2026-118082High· 8.8
1w ago

WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.

▾ TwilightBuddyBoss · Buddyboss PlatformEPSS 0.36%via CVEORG
CVE-2026-118083High· 7.5
1w ago

WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.

▾ TwilightThemeum · wp-crowdfundingEPSS 0.30%via CVEORG
CVE-2026-54865Medium· 6.5
1w ago

WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

▾ SunlitPodamibe Nepal · podamibe-custom-user-gravatarEPSS 0.22%via CVEORG
CVE-2026-61996High· 8.5
1w ago

WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

▾ Twilightfavethemes · MLS On The FlyEPSS 0.38%via CVEORG
CVE-2026-116848Medium· 6.5
1w ago

WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This …

▾ SunlitPOSIMYTH Innovations · the-plus-addons-for-elementor-page-builderEPSS 0.13%via CVEORG
CVE-2026-118084Medium· 6.5
1w ago

WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.

▾ Sunlitnicdark · nd-bookingEPSS 0.33%via CVEORG
CVE-2026-115610Medium· 6.5
1w ago

WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.

▾ SunlitPublishPress · publishpress-authorsEPSS 0.14%via CVEORG
CVE-2026-107023Medium· 6.5PoC
1w ago

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.

▾ TwilightEPSS 0.26%via CVEORG
CVE-2026-114706Medium· 6.5
1w ago

WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.

▾ SunlitWP Chill · strong-testimonialsEPSS 0.13%via CVEORG
CVE-2026-107028Critical· 9.1PoC
1w ago

Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.

Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.

▾ AbyssalEPSS 0.34%via CVEORG
CVE-2026-107017Critical· 9.1PoC
1w ago

Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.

Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.

▾ AbyssalEPSS 0.34%via CVEORG
CVE-2026-107060Critical· 9.1PoC
1w ago

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

▾ AbyssalEPSS 0.28%via CVEORG
CVE-2026-107034Critical· 9.1PoC
1w ago

Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.

Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.

▾ AbyssalEPSS 0.37%via CVEORG
CVE-2026-107044High· 7.5PoC
1w ago

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.

▾ MidnightEPSS 0.31%via CVEORG
CVE-2026-107039High· 7.5PoC
1w ago

Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS).

Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service (DoS).

▾ MidnightEPSS 0.49%via CVEORG
CVE-2026-107049High· 7.5PoC
1w ago

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.

An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.

▾ MidnightEPSS 0.31%via CVEORG
CVE-2026-107055High· 7.5PoC
1w ago

Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.

Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.

▾ MidnightEPSS 0.26%via CVEORG
CVE-2026-92744High· 8.7PoC
1w ago

Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

▾ MidnightDelinea · Privilege ManagerEPSS 0.26%via CVEORG
CVE-2026-115943Critical· 9.8
1w ago

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condit…

▾ MidnightEPSS 0.61%via CVEORG
CVE-2025-13050Medium· 5.4
1w ago

Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user

▾ SunlitCentreon · https://central.platform/centreonEPSS 0.26%via CVEORG
CVE-2026-41216High· 7.5
1w ago

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this…

▾ Twilightvtk · vtkEPSS 0.28%via CVEORG
CVE-2026-42057High· 7.5
1w ago

An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6

An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger thi…

▾ Twilightvtk · vtkEPSS 0.28%via CVEORG
CVE-2026-8822High· 7.5
1w ago

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1)

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1). A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vuln…

▾ Twilightvtk · vtkEPSS 0.31%via CVEORG
CVE-2026-8824High· 7.5
1w ago

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1)

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to tr…

▾ Twilightvtk · vtkEPSS 0.31%via CVEORG
CVEs tagged “cve.org” — page 139 · VulnSea