Tagged “cve.org”
CVEs tagged cve.org, newest first.
47225 CVEsRSS
CVE-2026-115957Medium· 6.5WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Stored XSS.This issue affects WP Discussion Board: from n/a through …
CVE-2026-115609High· 7.1WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS.This issue affects GetPaid: from n/a through 2.8.62.
CVE-2026-111411Critical· 9.3WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a throu…
CVE-2026-115607Critical· 9.3WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.
CVE-2026-115596High· 7.1PoCWordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n…
CVE-2026-115593High· 7.1WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected…
CVE-2026-115591High· 7.5WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5.
CVE-2026-115612High· 7.1WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS.This issue affects SliceWP: from n/a through 1.2.13.
CVE-2026-111850High· 8.5WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.
CVE-2026-116404Medium· 6.5WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability
Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This issue affects Redux Framework: from n/a through 4.5.16.
CVE-2026-116392High· 7.2WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: from n/a through 2.3.25.
CVE-2026-93516Medium· 5.5.Org Server XInput Passive Grab Use-After-Free
A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potential…
CVE-2026-116393High· 7.5WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optima Express: from n/a through 9.0.0.
CVE-2026-116391High· 8.8WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Logo Slider: from n/a through 3.8.9.
CVE-2026-118477Critical· 9.8KaliFast Project Management Platform ei_git_repo_url OS Command Injection
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute a…
CVE-2026-116855Medium· 5.4WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3.
CVE-2026-118485High· 8.1Axel Download Accelerator Path Traversal via URL Filename Decoding
Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (http_decode()) on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f (URL-encode…
CVE-2026-102799Medium· 5.3Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16
CVE-2026-81472Medium· 4.2Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulner…
Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulner…
CVE-2026-102790High· 8.6Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16
CVE-2026-114278Critical· 9.8PoCUnauthenticated Command Injection via kubeconfig Username in che-machine-exec
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocati…
CVE-2026-87101Medium· 6.2Sensitive information disclosure due to improper token validation
Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-87103High· 7.4Sensitive information disclosure and manipulation due to improper token validation
Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-87097Medium· 5.3Sensitive information disclosure due to insufficiently protected credentials
Sensitive information disclosure due to insufficiently protected credentials. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-86377High· 7.6Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
CVE-2026-87880Medium· 6.8Sensitive information disclosure due to missing SSL certificate verification affecting one component
Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-86378High· 8.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, conta…
CVE-2026-87100Low· 3.6Protection mechanism failure due to missing binary hardening in Linux executables
Protection mechanism failure due to missing binary hardening in Linux executables. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 42587.
CVE-2026-87099Medium· 5.7Cross-site scripting (XSS) vulnerability due to improper input validation
Cross-site scripting (XSS) vulnerability due to improper input validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-87098Low· 3.1Sensitive information disclosure due to improper authorization
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.