Tagged “cve.org”
CVEs tagged cve.org, newest first.
47299 CVEsRSS
CVE-2026-107907Medium· 6.5MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to t…
CVE-2026-97352Medium· 4.3News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News K…
CVE-2026-105199Medium· 6.8Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with …
CVE-2026-112207High· 7.1Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers t…
CVE-2026-110956Critical· 9.8asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, …
CVE-2026-113493Medium· 6.8GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cro…
CVE-2026-113491Medium· 6.4GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from …
CVE-2026-113489Medium· 4.3GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and …
CVE-2026-113674Low· 3.7GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to,…
CVE-2026-113673High· 7.2GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multi…
CVE-2026-113490Medium· 5.3GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink…
CVE-2026-114429Medium· 6.8WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform S…
CVE-2026-113492Medium· 5.3GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-pub…
CVE-2026-115802Medium· 4.3PoCInternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere
A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path cau…
CVE-2026-108013Medium· 6.8HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on…
CVE-2026-115807High· 7.1User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg R…
CVE-2026-115806Critical· 9.8Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUn…
CVE-2026-115929Medium· 6.8MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.5…
CVE-2026-118264Critical· 9.1Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-118261High· 8.2Echo: Decompress permits unbounded gzip expansion in v4
Echo: Decompress permits unbounded gzip expansion in v4
CVE-2026-118260High· 8.2Echo: BodyDump captures request and response bodies without size limits in v4
Echo: BodyDump captures request and response bodies without size limits in v4
CVE-2026-118263Medium· 6.3Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
CVE-2026-118262High· 8.2Echo: WebSocket proxy can retain connections and handlers after client disconnect
Echo: WebSocket proxy can retain connections and handlers after client disconnect
CVE-2026-118265Medium· 5.3Echo: X-Real-IP extractor trusts the header value instead of the sending peer
Echo: X-Real-IP extractor trusts the header value instead of the sending peer
CVE-2026-115935High· 8.8Control panel only API response emulation replaces "securityKey" and reaches server RCE
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes t…
CVE-2026-115801Medium· 5.3PoCKakao khaiii JSON Config File Linear.cpp open out-of-bounds
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the…
CVE-2026-115937High· 7.5Unauthenticated payment reuse allows unpaid orders to be marked as paid
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects whi…
CVE-2026-115938High· 8.8Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelp…
CVE-2026-115931Critical· 9.9Arbitrary file read and backend crash through unrestricted provider method calls
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be …
CVE-2026-115897Low· 2.1⚖ disputedSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-in…