Tagged “cve.org”
CVEs tagged cve.org, newest first.
47816 CVEsRSS
CVE-2026-17557Medium· 6.5Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows…
CVE-2026-111075High· 8.7JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unau…
CVE-2026-110938High· 8.7JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing
In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can…
CVE-2026-110899High· 7.1PoCWordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
CVE-2026-114236Low· 3.3Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
CVE-2026-114040Low· 3.5PoCDT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipula…
CVE-2026-114039Medium· 6.3PoCprojectworlds Advanced Library Management System report_search.php mysqli_query sql injection
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injecti…
CVE-2026-92823Medium· 6.2Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can …
CVE-2026-92824Medium· 6.2Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v…
CVE-2026-92822Medium· 6.2PoCLibmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can …
CVE-2026-102499High· 7.7Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Sub…
CVE-2026-100145Medium· 6.5Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, t…
CVE-2026-82819High· 7.1PoCUniversal Naming Convention (UNC) Path Injection in Cerberus FTP Server
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can execute authentication coercion against th…
CVE-2026-105262High· 8.0Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-…
CVE-2026-103302Medium· 5.3Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant credentials used to compute their checksum are empty by default, allowing unauthenticate…
CVE-2026-105992Medium· 5.3Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid witho…
CVE-2026-105257Low· 2.7LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate…
CVE-2026-107127High· 7.5Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an at…
CVE-2026-105999Medium· 5.3Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure
The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administr…
CVE-2026-105998Medium· 5.3Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin b…
CVE-2026-107506High· 7.5Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows use…
CVE-2026-107128Medium· 5.0Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite n…
CVE-2026-105996Medium· 4.8Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them instead from values it exposes publicly, so an unauthenticated attacker can reconstruct a…
CVE-2026-107237High· 8.2Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account …
CVE-2026-106932Medium· 6.5Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing a…
CVE-2026-107790Medium· 6.8WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing…
CVE-2026-107788Medium· 4.3SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitr…
CVE-2026-109147High· 7.1WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege us…
CVE-2026-108073Medium· 5.3SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthen…
CVE-2026-107789Medium· 5.3SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names,…