Tagged “cve.org”
CVEs tagged cve.org, newest first.
49989 CVEsRSS
CVE-2026-111410Medium· 6.5WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
CVE-2026-111414Medium· 6.5WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.…
CVE-2026-110363Medium· 5.4WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.
CVE-2026-111836Medium· 4.3WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.
CVE-2026-111831Medium· 5.3WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.
CVE-2026-112141High· 7.3PoCsatya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipula…
CVE-2026-38671Medium· 6.1Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of …
Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of …
CVE-2026-111845Medium· 5.3WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: fr…
CVE-2026-112142High· 7.3PoCsatya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Dele…
CVE-2026-8168Medium· 6.5qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements (CVE-2026-8168)
A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG (Scalable Vector Graphics) file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and…
CVE-2026-112143High· 7.3PoCsatya-vinay Events-Management-System missing authentication
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication…
CVE-2026-110008Medium· 4.2@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step a…
CVE-2026-110902Medium· 4.3WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a throu…
CVE-2026-108776Medium· 5.3Apache Kylin: tables/names SparkSQL injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue a…
CVE-2026-67249Medium· 5.4Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enfo…
CVE-2026-108780Medium· 6.5Apache Kylin: Potential JDBC source configuration validation issue
Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are r…
CVE-2026-108766Medium· 6.5Apache Kylin: missing JDBC-config authorization
Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue aff…
CVE-2026-108823High· 7.5Apache Kylin: Potential unauthenticated job metadata replacement
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 …
CVE-2026-108771Critical· 9.8Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments a…
CVE-2026-64943High· 8.1Apache Answer: API keys logged in plaintext during authentication
Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-…
CVE-2026-108837High· 7.5Apache Kylin: Potential computed-column resource exhaustion
Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Ky…
CVE-2026-108833High· 7.5Apache Kylin: default startup profile miss security settings
Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to v…
CVE-2026-64945High· 7.5Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission…
CVE-2026-64944Medium· 5.4Apache Answer: Stored XSS via unsanitized HTML in imported question content
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without pa…
CVE-2026-79624Critical· 9.8Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stal…
CVE-2026-71563Medium· 4.3Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with…
CVE-2026-68482Medium· 5.3Apache Answer: Improper Authorization in Question Invite User Lookup
Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing vi…
CVE-2026-79620Medium· 4.3Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to v…
CVE-2026-76994High· 7.5Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through publ…
CVE-2026-79633High· 8.1Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are reco…